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SUPERIOR  COURT  OF  THE  STATE  OF  CALIFORNIA 


COUNTY  OF  SAN  MATEO 


JOHN  O’CONNOR,  a  California  resident, 
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v. 

MARK  ZUCKERBERG, 

SHERYL  K.  SANDBERG, 

JAN  KOUM, 

MARC  L.  ANDREESSEN, 

PETER  A.  THIEL, 

REED  HASTINGS, 

ERSK3NE  B.  BOWLES, 

SUSAN  D.  DESMOND-HELLMAN, 
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JEFFREY  D.  ZIENTS, 

Defendants, 


Case  No.19-CIV-03759 
DERIVATIVE  COMPLAINT  FOR: 

(1)  DECLARATORY  RELIEF; 

(2)  VIOLATIONS  OF  CALIFORNIA 
CORPORATIONS  CODE  §  25400; 

(3)  VIOLATIONS  OF  CALIFORNIA 
CORPORATIONS  CODE  §  25401; 

(4)  VIOLATIONS  OF  CALIFORNIA 
CORPORATIONS  CODE  §  25402;  and 

(5)  CONTROL  PERSON  LIABILITY 
UNDER  CALIFORNIA 
CORPORATIONS  CODE  §  25504 


and 


FACEBOOK,  INC.,  a  Delaware  corporation 
with  principal  executive  offices  located  in 
California, 

Nominal  Defendant. 
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Plaintiff  John  O’Connor  (“Plaintiff’),  a  California  resident  and  a  shareholder  of 
Facebook,  Inc.  (“Facebook”  or  the  “Company”)  stock  continuously  since  February  21, 2017, 

brings  this  action:  (i)  individually  as  to  the  First  Cause  of  Action  for  declaratory  relief  pursuant 
to  section  1060  of  the  Code  of  Civil  Procedure;  and  (ii)  derivatively  on  behalf  of  Facebook  as 
to  the  Second  Cause  of  Action  for  violations  of  Corporations  Code  section  25400  (market 
manipulation),  the  Third  Cause  of  Action  for  violations  of  Corporations  Code  section  25401 
(false  and  misleading  statements),  the  Fourth  Cause  of  Action  for  violations  of  Corporations 
Code  section  25402  (insider  selling),  and  the  Fifth  Cause  of  Action  for  control  person  liability 
under  Corporations  Code  section  25403,  against  the  Individual  Defendants  (defined  below), 
who  are  liable  for  damages  and  equitable  remedies  under  Corporations  Code  sections  25500, 

f 

25501, 25502,  and  25504,  et  seq.,  respectively,  pursuant  to  section  800  of  the  Corporations 
Code,  and  alleges  as  follows: 

I.  SUMMARY  OF  THE  ALLEGATIONS 

1 .  On  March  1 7,  20 1 8,  the  New  York  Times  and  the  Observer  reported  that 

Cambridge  Analytica,  a  data  firm  retained  to  assist  the  Trump  election  campaign,  had  accessed 
and  retained  the  information  of  50  million  users  of  Facebook’ s  social  networking  website, 
without  their  authorization  and  informed  consent.  According  to  the  Observer,  a  whistleblower 
had  revealed  that  Cambridge  Analytica  utilized  Facebook’ s  app  developer  platform  to  obtain 
the  personal  information  of  Facebook  users  in  early  2014,  to  create  a  system  to  profile  U.S. 
voters  and  target  certain  of  those  individuals  with  personalized  political  advertisements. 
Christopher  Wylie  (“Wylie”),  a  Canadian  data  analytics  expert  who  worked  with  Cambridge 
Analytica  and  Cambridge  research  professor  Dr.  Aleksandr  Kogan  (“Kogan”)  to  create  the 
dataset,  told  the  Observer:  “We  exploited  Facebook  to  harvest  millions  of  people’s  profiles. 
And  built  models  to  exploit  what  we  knew  about  them  and  target  their  inner  demons.  That  was 
the  basis  the  entire  company  was  built  on.”  Facebook  subsequently  confirmed  that  Cambridge 
Analytica  had  access  to  and  may  have  used  the  personal  information  of  at  least  50  million 
Facebook  users  -  later  increased  to  at  least  87  million  users  -  most  of  whom  are  U.S.  citizens. 
Cambridge  Analytica  collected  user  data  collected  through  an  application  or  “app”  called 
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“thisisyourdigitallife”  designed  by  Kogan  and  his  company,  Global  Science  Research  (“GSR”). 
GSR,  in  collaboration  with  Cambridge  Analytica,  created  the  app,  which  was  a  personality  test, 
with  the  collected  data  supposedly  to  be  used  for  academic  purposes.  Approximately  270,000 
people  downloaded  the  app  using  their  Facebook  login  credentials.  However,  this  was  not  the 
reason  that  the  story  made  headlines.  Rather,  the  “news”  was  that  Cambridge  Analytica  had 
obtained  Facebook  users’  personal  information  and  other  data  via  Facebook’s  platform,  which 
was  permitted  -  and  encouraged  -  by  Facebook’s  platform  and  policies.  Kogan,  like  hundreds 
of  thousands  of  other  third  party  apps,  obtained  Facebook  users’  personal  information,  and  that 
of  their  friends,  without  their  knowledge  and  consent.  Kogan  then  shared  with  Cambridge 
Analytica  for  use  on  the  Trump  election  campaign. 

2.  Neither  Facebook’s  chief  executive  officer  (“CEO”),  defendant  Mark  Zuckerberg 
(“Zuckerberg”),  nor  its  chief  operating  officer  (“COO”),  defendant  Sheryl  Sandberg 
(“Sandberg”),  made  any  public  statement  initially  in  response  to  the  reports  regarding 
Cambridge  Analytica.  Instead,  in  a  comment  to  the  Guardian,  a  “Facebook  spokeswomen” 
stated,  “Mark,  Sheryl  and  their  teams  are  working  around  the  clock  to  get  all  the  facts  and  take 
the  appropriate  action  moving  forward,  because  they  understand  the  seriousness  of  this  issue. 
The  entire  company  is  outraged  we  were  deceived.  We  are  committed  to  vigorously  enforcing 
our  policies  to  protect  people’s  information  and  will  take  whatever  steps  are  required  to  see  that 
this  happens.” 

3.  Facebook  was  not  deceived,  at  least  not  by  Cambridge  Analytica.  The 
Company’s  public  (minority)  shareholders,  users  of  the  ubiquitous  social  networking  website, 
and  the  public  in  general  were,  however,  as  Facebook’s  top  executives  and  members  of  its 
Board  of  Directors  (the  “Board”)  intentionally  misrepresented  the  nature  of  Facebook’s 
business,  which  depended  upon  the  Company’s  ability  to  obtain  information  about  its  users  that 
they  voluntarily  shared  with  Facebook  on  its  website,  as  well  as  its  surreptitious,  deceptive  and 
often  unlawful  business  practices,  for  over  a  decade. 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

2 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


Case  4:18-cv-01792-HSG  Document  124-2  Filed  08/01/19  Page  9  of  143 


4.  Defendants  deliberately  concealed  the  fact  that  Facebook’s  platform  allowed  any 
third  party  app  developer  to  access  information  about  Facebook  users,  and  could  use  that 
information  for  various  purposes,  just  like  Cambridge  Analytica  had  done. 

5.  Indeed,  gathering  user  data  was  Facebook’s  self-proclaimed  goal  from  the  time  it 
launched  its  platform  in  2007,  and  the  Company’s  business  has  grown  along  with  Facebook’s 
user  base.  Facebook  monetizes  user  data  by  selling  advertisements  targeted  specifically  to  its 
users,  and  the  Company’s  unique  ability  to  offer  targeted  advertising  services,  which  depend 
upon  the  data  Facebook  gathers  from  its  users,  has  allowed  it  to  dominate  the  online  advertising 
market. 

6.  Defendants  knew  that  Facebook’s  business  depends  on  maintaining  user  trust  and 
confidence  in  the  security  of  their  personal  information  that  they  share  on  Facebook. 

Moreover,  Defendants  were  required  to  know,  and  they  were  required  to  ensure  that  Facebook 
maintained  adequate  internal  controls  and  procedures  to  monitor  and  enforce  violations  of 
Facebook’s  policies,  pursuant  to  the  terms  of  a  consent  agreement  that  Facebook  was  forced  to 
enter  into  to  resolve  the  U.S.  Federal  Trade  Commission  (the  “FTC”)  complaint  for  violations 
of  the  FTC  Act  after  the  FTC  found  in  201 1  that  Facebook  made  misrepresentations  about  the 
extent  to  which  it  protected  user  privacy  and  falsely  stated  that  it  did  not  provide  advertisers 
with  information  about  Facebook  users  without  their  consent  (among  other  things). 

7.  The  consent  agreement  was  subsequently  entered  as  an  order  (the  “Consent 
Order”)  that  specifically  required  Facebook  to  implement  and  maintain  policies  designed  to 
ensure  that  user  data  was  protected  and  that  third  parties  could  only  access  user  data  through 
Facebook’s  platform  if  they  complied  with  its  policies  and  obtained  the  express  consent  of 
Facebook  users.  Facebook  was  also  prohibited  from  “making  any  further  deceptive  privacy 
claims,”  and  from  “misrepresenting]  in  any  manner,  expressly  or  by  implication,  the  extent  to 
which  it  maintains  privacy  or  security  of  [user]  information,”  and  required  to  accurately 
describe  its  practices  with  respect  to  the  “collection  [and]  disclosure  of  any  [user]  information” 
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and  “the  extent  to  which  [Facebook]  makes  or  has  made  [user]  information  accessible  to  third 
parties”  (among  other  things). 

8.  Despite  the  FTC  Consent  Order,  which  all  of  the  members  of  Facebook’s  Board 
of  Directors  (the  “Board”)  received  and  were  required  to  comply  with,  Defendants  falsely 
represented  throughout  the  relevant  period  while  it  was  in  effect  that  Facebook  protected  the 
personal  information  of  its  users  by  ensuring  that  third  parties  could  only  access  user  data  if 
they  complied  with  Facebook’s  policies  and  obtained  the  express  consent  of  Facebook  users. 

9.  Rather  than  monitoring  and  enforcing  Facebook’s  policies  and  promises  to 
protect  user  privacy,  and  contrary  to  their  public  statements,  the  Individual  Defendants  turned  a 
blind  eye  to  repeated  violations,  and  made  false  and  misleading  statements  about  the 
fundamental  nature  of  Facebook’s  business,  its  dependence  on  obtaining  user  data,  and  the 
Company’s  practices  with  respect  to  the  security  of  user  data. 

10.  Accordingly,  Facebook’s  initial  statements  in  response  to  the  Cambridge 
Analytica  scandal  denied  any  wrongdoing  by  Facebook’s  employees  or  that  anyone  at  the 
Company  was  responsible  for  causing  the  leak  of  Facebook  user  data  to  Cambridge  Analytica. 
Rather,  Facebook  representatives  stated  that  Kogan  had  violated  Facebook’s  platform  policies, 
including  those  relating  to  Facebook’s  developer  application  programming  interface  (“API”), 
and  that  the  Company  had  learned  of  the  so-called  “violation”  as  early  as  2015,  but  by  then,  the 
applicable  policy  had  already  been  changed  to  clearly  indicate  that  any  similar  instance  of  a 
third  party  app  obtaining  user  information  via  the  platform  was  a  violation  of  Facebook’s 
policy.  Further,  Defendants  represented  that  Facebook  had  implemented  app  review  standards 
that  were  designed  to  ensure  that  nothing  similar  would  be  permitted  to  occur  on  Facebook’s 
platform,  and  third  party  apps  would  not  be  able  to  use  Facebook  users’  information  platform 
in  that  way  ever  again. 

1 1 .  But  Defendants  did  not  disclose  that  the  platform  policy  applied  only  to  third 
party  app  developers,  not  to  Facebook  apps.  Defendants  also  did  not  disclose  that  Facebook 
failed  to  monitor  and  enforce  those  policies,  and  that  other  third  party  companies  still  had 
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access  to  user  data  and  could  use  it  for  the  same  type  of  nefarious  purposes  as  Kogan  and 
Cambridge  Analytica. 

12.  Moreover,  Defendants  failed  to  disclose  a  plethora  of  unlawful  business  practices 
that  contributed  to  Facebook’s  growth,  and  which  Defendants  permitted  to  continue  as 
Facebook  grew  exponentially  larger. 

1 3 .  Beginning  in  approximately  2011,  defendant  Mark  Zuckerberg  (“Zuckerberg”), 
Facebook’s  founder  and  Chief  Executive  Officer  (“CEO”),  oversaw  plans  to  consolidate  the 
social  network’s  power  and  control  competitors  by  treating  its  users’  data  as  a  bargaining  chip, 
while  publicly  proclaiming  to  be  protecting  that  data. 

14.  On  June  3,  2018,  an  article  published  by  The  New  York  Times  reported  that 
Facebook  had  entered  into  agreements  over  the  past  decade  with  at  least  60  device  makers, 
including  Apple,  Amazon,  BlackBerry,  Microsoft  and  Samsung,  that  allowed  them  to  access 
vast  amounts  of  Facebook  users'  personal  information,  including  data  about  friends  who  had 
blocked  such  third-party  access.  These  data-sharing  partnerships,  which  Facebook  has  entered 
into  since  2007,  before  the  Facebook  platform  became  ubiquitous,  gave  these  developers  the 
ability  to  offer  “features”  of  the  social  network,  such  as  messaging,  “like”  buttons  and  address 
books,  on  their  own  websites  and  mobile  devices. 

15.  The  following  day,  House  Judiciary  Committee  member  David  Cicilline 
(“Cicilline”)  (D-R.I.),  stated  that  defendant  Zuckerberg  had  “lied  to  Congress”  when  he 
testified  before  several  committees  in  April  of  2018  and  stated  that  Facebook  users  have 
“complete  control”  over  who  sees  their  data.  Cicilline  also  questioned  whether  Facebook’s 
data-sharing  practices  violate  the  FTC  Consent  Order,  which  required  Facebook  to,  among 
other  things,  “establish  and  implement,  and  thereafter  maintain,  a  comprehensive  privacy 
program  that  is  reasonably  designed  to  address  . . .  privacy  risks  related  to  the  development  and 
management  of  new  and  existing  products  and  services  for  consumers  . . ..”  It  also  bars 
Facebook  from  misrepresenting  the  extent  of  its  privacy  protections  and  mandates  that  it  get 
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explicit  consent  from  users  before  changing  the  way  their  data  is  shared  with  third  parties 
(among  other  things). 

16.  On  June  29,  2018,  in  response  to  Congressional  questions  to  Zuckerberg, 
Facebook  provided  a  747  page  document  and  admitted  that  it  actually  gave  dozens  of 
companies  special  access  to  user  data,  contrasting  with  the  Company’s  prior  public  statements. 
Indeed,  Facebook  disclosed  that  it  was  still  sharing  information  of  users’  friends,  such  as  name, 
gender,  birth  date,  current  city  or  hometown,  photos  and  page  likes,  with  over  60  app 
developers  nearly  six  months  after  it  said  it  stopped  access  to  this  data  in  2015.  Facebook  also 
disclosed  that  it  shared  information  about  its  users  with  52  hardware  and  software  makers, 
including  such  large  United  States  corporations  as  Amazon.com,  Apple  Inc.,  and  Microsoft 
Corp,  as  well  as  Chinese  firms  such  as  Huawei  Technologies  Co.  and  Alibaba  Group. 

1 7.  On  July  2,  2018,  the  Washington  Post  reported  that  the  SEC,  FTC,  and  FBI  have 
joined  the  DOJ  inquiry  “in  its  inquiries  about  the  two  companies”  (Facebook  and  Cambridge 
Analytica)  and  specifically  Facebook’s  “actions  and  statements”  over  a  period  of  years. 
According  to  the  Post,  the  inquiry  is  focused  on  what  Facebook  knew  years  ago  and  what  it 
failed  to  tell  “users  or  investors,”  as  well  as  whether  there  were  “discrepancies  in  more  recent 
accounts”  like  executives’  testimony  before  Congress.  Facebook  representatives  admitted  the 
focus  of  the  inquiry  is  “the  social  network’s  public  statements  about  Cambridge  Analytica.” 

18.  On  July  1 1 , 201 8,  the  Wall  Street  Journal  reported  that  the  SEC  is  also 
investigating  whether  Facebook  adequately  warned  investors  in  a  timely  manner  about  the 
possible  misuse  and  improper  collection  of  user  data. 

19.  Following  these  reports,  Facebook  released  its  earnings  report  for  the  second 
quarter  of  201 8  on  July  25, 201 8.  The  Company  missed  revenue  estimates,  offered  a  weak 
sales  forecast  for  future  quarters  and  reported  a  decline  of  users  in  Europe.  During  the  earnings 
conference  call,  Facebook  CFO  David  Wehner  stated  that  revenue  growth  will  fall  by  “high 
single-digit”  percentages  over  the  next  two  quarters,  partly  because  Facebook  planned  to  give 
people  more  options  with  their  privacy  settings,  including  letting  them  limit  the  kinds  of  ads 
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they  saw.  Zuckerberg  also  said  profits  would  most  likely  take  a  further  hit  because  the 
company  planned  to  spend  more  on  security.  As  a  result  of  this  revelation,  Facebook’s  stock 
price  was  down  18  percent  at  opening  on  July  26,  2018,  a  loss  of  more  than  $100  billion  in 
market  value. 

20.  The  bad  news  continued  when,  on  September  28,  2018,  Facebook  announced  that 
50  million  users  had  been  compromised  in  a  massive  data  breach  that  put  their  entire  accounts 
in  the  hands  of  unknown  rogue  actors.  An  additional  40  million  users  also  had  their  accounts 
reset  due  to  uncertainty  about  the  scope  of  the  breach.  Once  inside  Facebook’s  security  wall, 
the  attackers  stood  in  Facebook  users’  shoes  -  with  complete  and  total  control  over  their 
profiles,  accounts,  and  social  media  interactions.  The  attackers  also  gained  access  to  any  apps 
or  services  that  the  victims  had  linked  to  their  Facebook  account  using  the  “Facebook  Login” 
feature,  putting  users  of  thousands  of  other  apps  at  risk  of  having  their  accounts  hijacked  and 
misused. 

21 .  In  October  2018,  the  Company’s  image  was  further  tarnished  when  academics 
discovered  that  Facebook  was  using  contact  information  that  users  had  provided  for  security 
purposes,  such  as  for  two-factor  identification  logins,  to  engage  in  ad  targeting.  On  October  30, 
2018,  Facebook  announced  its  financial  results  for  the  third  quarter  of  2018,  and  Facebook’s 
Chief  Financial  Officer  (“CFO”),  David  Wehner  (“Wehner”),  stated  that  the  Company  would 
not  be  providing  revenue  guidance  for  2019.  Facebook’s  Form  10-Q  for  the  third  quarter  of 
2018,  filed  the  following  day,  disclosed  that  the  Company’s  operating  expenses  had 
significantly  risen  as  the  number  of  Facebook’s  employees  had  increased  to  33,606  from 
23,165  in  the  same  period  for  the  previous  year,  and  would  continue  to  rise,  as  the  Company 
“expect[sj  such  headcount  growth  to  continue  for  the  foreseeable  future.” 

22.  And,  on  November  1 5, 2018,  the  New  York  Times  published  a  bombshell  report 
following  an  investigation  that  revealed  Zuckerberg  and  Sandberg  “ignored  warning  signs  and 
then  sought  to  conceal  them  from  public  view”  over  the  past  three  years  and  “passed  off 
security  and  policy  decisions  to  subordinates.”  The  report  found  that  Facebook  tried  to  “deflect 
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blame”  and  “mask”  the  extent  of  the  Cambridge  Analytica  scandal.  The  report  indicates  that 
Facebook  knew  about  Russian  activity  on  the  platform  as  early  as  spring  2016,  more  than  a 
year  before  the  company  alerted  the  public,  and  Sandberg  clashed  with  Stamos  over  how  to 
handle  the  problem.  The  report  revealed  that  the  Audit  Committee  was  briefed  by  Stamos  and 
Stretch  regarding  Russian  activity  on  Facebook,  and  the  entire  Board  was  also  informed  at  the 
quarterly  Board  meeting  held  on  September  6,  2017.  The  Times  also  reported  that  Facebook 
had  resorted  to  “aggressive”  lobbying  tactics  and  tapped  its  Washington  connections  to  shift 
blame  to  tech  rivals  and  ward  off  critics,  and  had  hired  a  firm  known  for  opposition  research, 
Definers  Public  Affairs,  which  tried  to  discredit  critics  by  linking  liberal  billionaire  George 
Soros  to  activists  protesting  Facebook. 

23.  In  response  to  the  New  York  Times  story,  Facebook’s  “Lead  Independent 
Director,”  defendant  Susan  Desmond-Hellman,  issued  the  following  statement  on  behalf  of  the 
entire  Board,  in  support  of  defendants  Zuckerberg  and  Sandberg  on  November  15,  2018:  “As 
Mark  and  Sheryl  made  clear  to  Congress,  the  company  was  too  slow  to  spot  Russian 
interference,  and  too  slow  to  take  action.  As  a  board  we  did  indeed  push  them  to  move  faster. 
But  to  suggest  that  they  knew  about  Russian  interference  and  either  tried  to  ignore  it  or  prevent 
investigations  into  what  had  happened  is  grossly  unfair.  In  the  last  eighteen  months  Facebook, 
with  the  full  support  of  this  board,  has  invested  heavily  in  more  people  and  better  technology  to 
prevent  misuse  of  its  services,  including  during  elections.  As  the  U.S.  mid-term  showed,  they 
have  made  considerable  progress  and  we  support  their  continued  to  efforts  to  fight  abuse  and 
improve  security.” 

24.  By  November  16,  201 8,  Facebook’s  stock  price  had  fallen  to  new  2-year  lows. 
Defendants  continued  to  affirmatively  deny  that  Facebook’s  practices  violated  the  FTC 
Consent  Order,  or  any  other  law  or  regulation,  despite  a  multitude  of  foreign  government 
investigations  that  resulted  in  findings  and  adjudicated  violations  of  law  by  Facebook.  While 
Defendants’  false  and  misleading  statements  allowed  Facebook  to  evade  lawmakers,  and  avoid 
making  any  changes  to  its  platform  or  policies  that  could  affect  its  ability  to  obtain  and  share 
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user  data,  by  the  end  of  2018,  Facebook  had  incurred  substantial  fines,  penalties  and  other  costs 
as  a  result  of  Defendants’  illegal  business  practices,  and  they  have  caused  even  more  serious 
damage  to  Facebook’ s  brand  and  reputation.  At  the  same  time,  however,  Defendants  have 
personally  profited  from  Facebook’ s  increasing  user  base  and  record  revenues  attained  as  a 
direct  result  of  their  violations  of  the  California  Securities  Act  and  other  laws. 

25 .  On  April  24,  20 1 9,  Defendants  announced  that  they  expect  Facebook  to  pay 
somewhere  in  a  range  of  $3  billion  to  $5  billion  to  resolve  the  FTC’s  investigation  of  Facebook 
for  violations  of  the  Consent  Order. 

26.  But  even  this  is  not  the  extent  of  the  damages  that  Defendants’  violations  of  law 
have  caused  to  Facebook  -  multiple  other  U.S.  and  foreign  government  agencies  are  still 
investigating  and  attempting  to  determine  how  best  to  regulate  Facebook  and  other  tech  giants 
like  Apple  Inc.  (“Apple”)  and  Google,  Inc.  (“Google”),  which  are  virtually  Facebook’s  (and 
each  other’s)  only  competition. 

27.  Together,  Google  and  Facebook  dominate  the  online  advertising  market, 
capturing  approximately  60  percent  of  its  sales.  It  is  no  surprise  that  before  joining  Facebook 
in  2008,  the  Company’s  Chief  Operating  Officer  (“COO”),  defendant  Sheryl  Sandberg 
(“Sandberg”),  was  the  head  of  Google’s  advertising  business. 

28.  Most  recently,  Facebook  and  Google’s  duopoly  of  the  online  advertising  market 
has  come  under  fire.  Bloomberg  reported  on  May  3 1,  2019  that  the  U.S.  Department  of  Justice 
(“DOJ”)  and  the  FTC  are  investigating  Google  for  potential  antitrust  violations,  and  on  June  3, 
2019,  Bloomberg  reported  that  the  FTC  will  also  investigate  potential  antitrust  violations  by 

t 

Facebook  to  determine  whether  Facebook’s  practices  harm  competition  in  the  digital  market. 
On  this  news,  Facebook’s  stock  price  fell  7.5  percent. 

29.  By  this  action,  Plaintiff,  a  California  resident  and  a  shareholder  of  Facebook 
stock  since  February  21,  2017,  seeks,  in  the  First  Cause  of  Action  for  declaratory  relief:  (i)  a 
declaration  that  a  purported  forum  selection  clause  in  Article  IX  of  Facebook’s  Restated 
Certificate  of  Incorporation  is  invalid  on  its  face,  and  as  applied  to  the  causes  of  action  for 
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action  for  violations  of  the  California  Corporations  Code  that  are  alleged  in  this  Complaint,  and 
is  unenforceable  to  the  extent  it  seeks  to  prevent  Plaintiff  or  any  other  Facebook  shareholder 
from  asserting  derivative  claims  under  the  California  Securities  Law;  and  (ii)  that  the  Board’s 
adoption  and/or  refusal  to  grant  a  waiver  of  the  clause  constitutes  a  breach  of  their  fiduciary 
duties  owed  to  Facebook’s  shareholders,  and,  in  the  Second  through  Fifth  Causes  of  Action 
asserted  derivatively  on  behalf  of  Facebook:  (iii)  damages  and  (iv)  other  equitable  remedies  for 
the  Individual  Defendants’  violations  of  California  Corporations  Code  sections  25400, 25401, 
and  25402. 

II.  JURISDICTION  AND  VENUE 

30.  This  Court  has  subject  matter  jurisdiction  over  this  action  under  Article  VI, 
section  10  of  the  California  Constitution  and  California  Corporations  Code  section  800. 

3 1 .  This  Court  has  jurisdiction  over  each  of  the  Defendants  because  each  defendant 
conducts  business  in  California  including,  but  not  limited  to,  the  conduct  alleged  in  this 
complaint,  and  has  sufficient  contacts  with  California  in  order  to  render  the  exercise  of 
jurisdiction  by  this  Court  over  them  permissible  under  California  Code  of  Civil  Procedure 
section  410.10  as  well  as  the  United  States  and  California  Constitutions  and  traditional  notions 
of  fair  play  and  substantial  justice.  Facebook  is  headquartered  in  California  and  maintains  its 
principal  executive  offices  in  California,  and  Defendants,  by  their  wrongful  acts  alleged  herein, 
caused  substantial  harm  and  injury  in  California,  including  to  California  citizens. 

32.  Venue  is  proper  in  this  Court  because  Facebook  maintains  its  principal  executive 
office  in  Menlo  Park,  San  Mateo  County,  defendants  Sandberg  and  Koum  are  residents  of  San 
Mateo  County,  California,  and  the  wrongful  acts  alleged  herein  occurred  in  or  emanated  from 
San  Mateo  County. 

33 .  Venue  is  proper  in  this  Court  notwithstanding  a  “choice  of  forum”  provision  in 
Facebook’s  Restated  Certificate  of  Incorporation  that  purports  to  designate  the  Court  of 
Chancery  of  the  State  of  Delaware  (the  “Delaware  Chancery  Court”)  as  the  “sole  and  exclusive 
forum”  for  any  derivative  action  on  behalf  of  the  Company  and  any  action  that  asserts  a  claim 
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against  a  director,  officer,  employee  or  agent  of  Facebook  for  breach  of  fiduciary  duty  “or  other 

wrongdoing”  which  is  invalid  and/or  unenforceable,  as  alleged  below. 

A.  The  “Choice  of  Forum”  Provision  in  Facebook’s  Restated  Certificate 

of  Incorporation  is  Invalid  and  Unenforceable 


34.  Facebook  filed  its  original  Certificate  of  Incorporation  with  the  Secretary  of  State 
of  the  State  of  Delaware  on  July  29, 2004,  under  the  name  TheFacebook,  Inc.  On  May  22, 
2012,  Facebook,  Inc.’s  Restated  Certificate  of  Incorporation  (the  “Restated  Certificate  of 
Incorporation”)  was  filed  with  the  Secretary  of  State  of  the  State  of  Delaware,  and  it  remains 
the  operative  version  that  is  currently  in  effect. 

35.  Facebook’s  Restated  Certificate  of  Incorporation  contains  a  so-called  “Choice  of 
Forum”  provision  in  Article  IX  (referred  to  herein  as  the  “Forum  Provision”),  which  states: 

ARTICLE  IX:  CHOICE  OF  FORUM 

Unless  the  corporation  consents  in  writing  to  the  selection  of  an  alternative  forum, 
the  Court  of  Chancery  of  the  State  of  Delaware  shall,  to  the  fullest  extent  permitted 
by  law,  be  the  sole  and  exclusive  forum  for  (1)  any  derivative  action  or  proceeding 
brought  on  behalf  of  the  corporation,  (2)  any  action  asserting  a  claim  of  breach  of 
a  fiduciary  duty  owed  by,  or  other  wrongdoing  by,  any  director,  officer,  employee 
or  agent  of  the  corporation  to  the  corporation  or  the  corporation’s  stockholders,  (3) 
any  action  asserting  a  claim  arising  pursuant  to  any  provision  of  the  General 
Corporation  Law  or  the  corporation’s  Restated  Certificate  of  Incorporation  or 
Bylaws,  (4)  any  action  to  interpret,  apply,  enforce  or  determine  the  validity  of  the 
corporation’s  Restated  Certificate  of  Incorporation  or  Bylaws  or  (5)  any  action 
asserting  a  claim  governed  by  the  internal  affairs  doctrine,  in  each  such  case  subject 
to  said  Court  of  Chancery  having  personal  jurisdiction  over  the  indispensable 
parties  named  as  defendants  therein.  Any  person  or  entity  purchasing  or  otherwise 
acquiring  any  interest  in  shares  of  capital  stock  of  the  corporation  shall  be  deemed 
to  have  notice  of  and  consented  to  the  provisions  of  this  ARTICLE  IX. 

36.  Facebook’s  Board  adopted  the  Forum  Provision  more  than  seven  years  ago,  in 
2012,  and  despite  the  Delaware  legislature  having  subsequently  enacted  a  statute  in  2015 
setting  forth  the  proper  scope  of  a  forum  selection  clause  adopted  by  a  board  of  directors  of  a 
Delaware  corporation,  Facebook’s  Board  has  failed  to  modify  the  Forum  Provision  to  comply 
with  the  applicable  statutory  provision  in  the  Delaware  General  Corporation  Law  (“DGCL”), 
section  115  (“Section  115”).  Instead,  Facebook’s  Board  has  sought  to  enforce  the  Forum 
Provision  in  other  derivative  litigation,  confirming  that  it  impermissibly  seeks  to  prevent 
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shareholders  from  asserting  any  statutory  derivative  claims,  including  causes  of  action  under 
both  federal  and  California  securities  laws,  not  for  any  legitimate  reason  that  has  been 
recognized  by  Delaware  courts  as  beneficial  or  that  could  potentially  benefit  Facebook,  but  for 
their  own  self-interested  purposes. 

37.  As  alleged  below,  Facebook’s  Forum  Provision  is  invalid  on  its  face,  because  it  is 
inconsistent  with  Delaware  General  Corporation  Law  (“DGCL”)  section  115,  and  as  applied  to 
this  particular  case,  its  application  would  be  unreasonable  because  it  impermissibly  seeks  to 
regulate  “external”  affairs  and  relationships  not  created  by  or  subject  to  the  jurisdiction  of  the 
State  of  Delaware  and  would  prevent  Plaintiff  from  asserting  causes  of  action  under  California 
law  against  the  Individual  Defendants  (defined  below),  that  are  broader  and/or  provide 
additional  remedies  that  are  not  available  under  Delaware  law. 

38.  The  Forum  Provision  is  also  invalid  and  cannot  be  equitably  enforced  because  it 
was  adopted  and  affirmatively  approved  and  is  maintained  by  Facebook’s  Board  for  improper 
and  self-interested  purposes  that  are  inconsistent  with  the  directors’  fiduciary  duties  owed  to 
Facebook  and  its  minority  shareholders,  as  alleged  below. 

39.  Moreover,  the  Forum  Provision  is  invalid  and/or  unenforceable  in  the  State  of 
California,  because  it  is  against  public  policy  to  allow  the  Individual  Defendants  to  escape 
liability  for  their  violations  of  the  California  securities  laws,  and  it  is  unconscionable  under 
applicable  California  law  because  the  Forum  Provision  seeks  to  diminish  or  eliminate  the 
substantive  rights  afforded  to  shareholders  under  California  law,  including  under  the  California 
Corporations  Code,  without  the  consent  of  Facebook’s  minority  shareholders  and  without  their 
ability  to  meaningfully  consent,  or  to  vote  to  modify  or  repeal  the  Forum  Provision,  as  alleged 
below. 

40.  Alternatively,  the  Forum  Provision  is  unenforceable  and/or  unconscionable  as  to 
this  particular  case  or  as  to  Plaintiff,  because  it  seeks  to  entirely  foreclose  this  action,  which  is 
brought  by  Plaintiff,  a  California  resident,  derivatively  on  behalf  of  Facebook,  a  corporation 
that  is  headquartered  in  California,  against  individual  defendants  who  are  California  residents, 
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and  the  causes  of  action  under  the  California  Corporations  Code  cannot  be  brought  in  the 

Delaware  Chancery  Court.  Further,  Plaintiff  did  not  consent  to  the  Forum  Provision. 

B.  This  Court  Has  Jurisdiction  Over  the  Causes  of  Action  Alleged 
Herein 

41 .  As  alleged  below,  the  Delaware  Chancery  Court  does  not  have  jurisdiction  to 
determine  claims  under  any  state  or  federal  statute,  including  Delaware  statutes  that  do  not 
expressly  provide  that  the  Delaware  Chancery  Court  shall  have  “exclusive  jurisdiction”  as 
among  the  courts  in  Delaware  to  determine  such  claims. 

42.  Furthermore,  there  is  no  statutory  basis  for  the  Delaware  Chancery  Court  to 
exercise  personal  jurisdiction  over  Plaintiff  or  any  other  shareholder  solely  by  virtue  of  his  or 
her  share  ownership,  and  the  Delaware  Chancery  Court  has  specifically  noted  that  it  most 
likely  would  not  have  jurisdiction  in  those  circumstances. 

43 .  The  Delaware  Chancery  Court  “is  a  court  of  limited  jurisdiction. . . .  Essentially, 
the  Court  of  Chancery  is  a  court  of  equity,  requiring  an  equitable  cause  of  action  ...  or  a 
plaintiffs  need  for  an  equitable  remedy  (such  as  injunction)  to  confer  jurisdiction.”  Helix 
Generation  LLC  v.  Transcanada  Facility  USA,  Inc.,  2019  WL  2068659,  at  *1  (Del,  Ch.  May 
10,  2019).  “The  Delaware  Code  states  that  [the]  Court  [of  Chancery]  ‘shall  not  have 
jurisdiction  to  determine  any  matter  wherein  sufficient  remedy  may  be  had  by  common  law,  or 
statute,  before  any  other  court...’”  Id.  (quoting  10  Del.  C.  §  342). 

44.  This  California  Superior  Court  has  jurisdiction  over  Plaintiffs  claims  under  the 
California  Corporations  Code,  and  where  (as  here),  another  court  can  properly  provide  a 
remedy  that  “would  be  sufficient,  that  is,  complete,  practical  and  efficient,  th[e]  [Delaware] 
Court  [of  Chancery]  is  without  jurisdiction.”  See  Helix  Generation  LLC,  2019  WL  2068659, 

at  *  1  (emphasis  added). 

III.  PARTIES 

A.  Plaintiff 

45.  Plaintiff  John  O’Connor  is  a  shareholder  of  Facebook  and  has  continuously  held 

his  Facebook  stock  since  February  21, 2017. 

A.  Nominal  Defendant 
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46.  Facebook,  Inc.  is  a  Delaware  corporation  with  its  principal  office  located  at  1 
Hacker  Way,  Menlo  Park,  California.  Facebook  owns  three  of  the  world’s  largest  social 
networks,  including  Facebook,  Instagram,  and  WhatsApp.  Facebook  has  dual-class  stock,  and 
only  the  shares  of  its  Class  A  common  stock  are  traded  publicly  on  the  NASDAQ  under  the 
symbol  “FB.”  Class  A  shareholders  have  one  vote  for  each  share,  while  the  Class  B 

shareholders  have  ten  votes  for  each  share  held. 

B.  Individual  Defendants 

47.  Defendant  Mark  Zuckerberg  (“Zuckerberg”)  is  the  founder  and  CEO  of  Facebook 
and  Chairman  of  the  Board.  According  to  Facebook’s  website,  Zuckerberg  “is  responsible  for 
setting  the  overall  direction  and  product  strategy  for  the  company”  and  “leads  the  design  of 
Facebook’s  service  and  development  of  its  core  technology  and  infrastructure.”  Zuckerberg  is 
the  Company’s  controlling  stockholder  with  ownership  of  Facebook  voting  shares  representing 
more  than  60%  of  Facebook’s  voting  power. 

48.  Defendant  Sheryl  Sandberg  (“Sandberg”)  is  Facebook’s  chief  operating  officer 
(“COO”)  since  2008  and  a  Facebook  director  since  2012.  Before  she  joined  Facebook  in  2008, 
Sandberg  was  Vice  President  of  Global  Online  Sales  and  Operations  at  Google,  Inc. 

(“Google”). 

49.  Defendant  Jan  L.  Koum  (“Koum”)  is  a  co-founder  of  WhatsApp,  Inc. 
(“WhatsApp”),  a  Facebook  subsidiary,  and  was  CEO  of  WhatsApp  and  a  Facebook  director 
until  April  2018.  Koum  was  a  security  and  infrastructure  engineer  at  Yahoo  Inc.  from  1998 
until  2007,  and,  in  2009,  he  designed  and  launched  the  WhatsApp  mobile  messaging  service. 
Koum  joined  Facebook’s  Board  when  WhatsApp  was  acquired  by  Facebook  in  2014,  and  in 
April  2018,  Koum  resigned  as  CEO  of  WhatsApp  and  left  his  position  on  Facebook’s  Board. 

50.  Defendant  Peter  A.  Thiel  (“Thiel”)  is  a  Facebook  director  since  April  2005  and  is 
a  Member  of  the  Compensation  &  Governance  Committee.  Thiel  is  the  co-founder  of  PayPal, 
Inc.  (“PayPal”),  an  online  payment  company,  where  he  served  as  CEO,  President  and 
Chairman  of  its  board  of  directors  until  it  was  acquired  by  eBay,  Inc.  (“eBay”)  in  2002.  Thiel 
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is  also  a  founder  of  Palantir  Technologies  (“Palantir”),  a  secretive  analytical  software  company, 
of  Thiel  Capital,  an  investment  firm,  and  of  Thiel  Capital,  a  venture  capital  firm,  and  he  is  a 
Partner  of  Thiel  Capital  since  2011  and  a  Partner  of  Thiel  Capital  since  2005. 

5 1 .  Defendant  Marc  L.  Andreessen  (“Andreessen”)  is  a  Facebook  director  since  June 
2008  and  is  a  Member  of  the  Audit  &  Risk  Oversight  Committee.  Andreessen  was  also  a 
member  of  the  Board’s  Compensation  &  Governance  Committee  until  May  2018.  Andreessen 
is  a  co-founder  and  has  been  a  General  Partner  of  Andreessen  Horowitz,  a  venture  capital  firm, 
since  July  2009  and  was  a  member  of  the  boards  of  directors  of  eBay  from  September  2008  to 
October  2014,  Hewlett-Packard  Company  from  September  2009  to  October  2015,  and  Hewlett 
Packard  Enterprise  Company  from  November  2015  to  April  2018. 

52.  Defendant  Susan  D.  Desmond-Hellmann  (“Desmond-Hellman”)  is  a  Facebook 
director  since  March  2013  and  is  Facebook’s  Lead  Independent  Director  and  a  Member  of  the 
Compensation  &  Governance  Committee.  Desmond-Hellmann  was  also  a  member  of 
Facebook’s  Audit  Committee  until  May  2018. 

53.  Defendant  Kenneth  I.  Chenault  (“Chenault”)  is  a  Facebook  director  since 
February  2018  and  is  a  Member  of  the  Audit  &  Risk  Oversight  Committee.  Chenault  is 
Chairman  and  a  Managing  Director  at  General  Catalyst,  a  venture  capital  firm. 

54.  Defendant  Jeffrey  D.  Zients  (“Zients”)  is  a  Facebook  director  since  May  2018 
and  is  the  Chair  of  the  Audit  &  Risk  Oversight  Committee.  Zients  is  the  CEO  of  the 
Cranemere  Group  Limited,  a  diversified  holding  company. 

55.  Defendant  Reed  Hastings  (“Hastings”)  was  a  Facebook  director  from  June  201 1 
until  May  2019  and  was  the  Chair  of  the  Compensation  &  Governance  Committee.  Hastings  is 
CEO  and  Chairman  of  the  board  of  directors  of  Netflix,  Inc.  (“Netflix”),  a  provider  of  an 
Internet  subscription  service  for  movies  and  television  shows,  since  1999,  and  previously  was  a 
member  of  the  board  of  directors  of  Microsoft  Corporation  from  March  2007  to  November 
2012. 
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56.  Defendant  Erskine  B.  Bowles  (“Bowles”)  was  a  Facebook  director  from 
September  2011  until  May  2019  and  was  a  Member  of  the  Audit  &  Risk  Oversight  Committee. 

57.  The  defendants  identified  above  in  fflj  47-56  are  collectively  referred  to  as 
“Individual  Defendants”  and,  together  with  nominal  defendant  Facebook,  as  “Defendants.” 

IV.  GENERAL  ALLEGATIONS  PERTAINING  TO  ALL  CAUSES  OF  ACTION 

58.  Each  of  the  Individual  Defendants:  (a)  directly  participated  in  the  management  of 

the  Company;  (b)  was  directly  involved  in  the  day-to-day  operations  of  the  Company  at  the 
highest  levels;  (c)  was  privy  to  confidential  proprietary  information  concerning  the  Company 
and  its  business  and  operations;  (d)  was  involved  in  drafting,  producing,  reviewing  and/or 
disseminating  the  false  and  misleading  statements  and  information  alleged  herein;  (e)  was 
aware  of  or  recklessly  disregarded  the  fact  that  the  false  and  misleading  statements  were  being 
issued  concerning  the  Company;  and/or  (f)  approved  or  ratified  the  false  and  misleading 
statements  issued  by  or  on  behalf  of  Facebook  or  other  Individual  Defendants,  and  is  liable  for 

violations  of  the  California  Corporations  Code,  as  alleged  herein. 

A.  Duties  of  the  Individual  Defendants 

59.  Each  of  the  Individual  Defendants,  by  reason  of  their  positions  as  officers  and 
directors  of  Facebook,  owed  Facebook  and  its  minority  shareholders  fiduciary  duties  including 
the  duty  to  act  in  good  faith  and  exercise  reasonable  care  and  diligence  in  the  administration  of 
the  affairs  of  the  Company  and  in  the  use  and  preservation  of  its  property  and  assets,  and  the 
highest  obligations  of  trust,  loyalty,  good  faith,  candor,  and  due  care,  and  were  required  to  use 
their  utmost  ability  to  control  and  manage  Facebook  in  a  fair,  just,  honest,  and  equitable 
manner.  The  Individual  Defendants  were  required  to  act  in  furtherance  of  the  best  interests  of 
Facebook  and  its  minority  shareholders  so  as  to  benefit  all  shareholders  equally  and  not  in 
furtherance  of  their  personal  interests  or  benefit. 

60.  To  discharge  their  duties  as  Facebook’s  officers  and  directors,  the  Individual 
Defendants  were  required  to  exercise  reasonable  and  prudent  supervision  over  Facebook’s 
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management,  policies,  practices,  and  controls  of  the  affairs  of  the  Company.  Accordingly,  the 
Individual  Defendants  were  required  to: 

61 .  (a)  ensure  that  Facebook  was  operated  in  a  diligent,  honest,  and  prudent 
manner  in  accordance  with  its  bylaws  and  charter,  as  well  as  the  laws  and  regulations  of  the 
State  of  Delaware,  the  State  of  California  and  the  United  States; 

62.  (b)  conduct  the  affairs  of  the  Company  in  an  efficient,  business-like  manner 
so  as  to  make  it  possible  to  provide  the  highest  quality  performance  of  its  business,  to  avoid 
wasting  the  Company’s  assets,  and  to  maximize  the  value  of  the  Company’s  stock; 

63.  (c)  remain  informed  as  to  how  Facebook  conducted  its  operations,  and,  upon 
receipt  of  notice  or  information  of  imprudent  or  unsound  conditions  or  practices,  to  make 
reasonable  inquiry  in  connection  therewith,  and  to  take  steps  to  correct  such  conditions  or 
practices; 

64.  (d)  establish  and  maintain  systematic  and  accurate  records  and  reports  of  the 
business  and  internal  affairs  of  Facebook  and  procedures  for  the  reporting  of  the  business  and 
internal  affairs  to  the  Board  and  to  periodically  investigate,  or  cause  independent  investigation 
to  be  made  of,  said  reports  and  records; 

65.  (e)  maintain  and  implement  an  adequate  and  functioning  system  of  internal 
legal,  financial,  and  management  controls,  such  that  Facebook’ s  operations  would  comply  with 
all  laws  and  its  financial  statements  filed  with  the  SEC  and  disseminated  to  the  public  and 
Facebook’s  shareholders  would  be  accurate; 

66.  (f)  exercise  reasonable  control  and  supervision  over  the  public  statements 
made  by  the  Company’s  officers  and  employees  and  any  other  reports  or  information  that  the 
Company  was  required  by  law  to  disseminate;  and 

67.  (g)  examine  and  evaluate  any  reports  of  examinations,  audits,  or  other 
financial  information  concerning  the  financial  affairs  of  the  Company  and  to  make  full  and 
accurate  disclosure  of  all  material  facts  concerning,  among  other  things,  each  of  the  subjects 
and  duties  set  forth  above. 
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68.  As  senior  executive  officers  and  directors  of  a  publicly-traded  company  whose 
Class  A  common  stock  was  registered  with  the  SEC  pursuant  to  the  Exchange  Act  and  traded 
on  the  NASDAQ  Global  Select  Market  (“NASDAQ”),  at  all  relevant  times  mentioned  in  this 
Complaint,  each  of  the  Individual  Defendants  had  a  duty  to  disseminate  accurate  and  truthful 
information  with  respect  to  the  Company’s  financial  condition  and  performance,  growth, 
operations,  financial  statements,  business,  products,  management,  earnings,  and  present  and 
future  business  prospects;  and  to  correct  any  previously-issued  statements  that  had  become 
materially  misleading  or  untrue,  so  that  the  market  price  of  the  Company’s  common  stock 
would  be  based  upon  truthful  and  accurate  information. 

69.  During  the  relevant  period,  the  Individual  Defendants  made,  caused  and/or 
allowed  to  be  made  by  or  on  behalf  of  Facebook  the  false  and  misleading  statements  and 
omissions  that  violated  California  Corporations  Code  section  25401,  and  that  caused 
Facebook’s  stock  to  trade  at  higher  prices  than  if  the  omitted  facts  or  other  information  had 
been  accurately  disclosed,  and  engaged  in  other  “market  manipulation”  conduct  that  violated 
section  25400,  and  subdivision  (d)  thereof,  including  approving  a  “share  repurchase  program” 
in  2016  and  increased  authorizations  in  2017  and  2018,  for  the  repurchases  of  over  $14  billion 
worth  of  shares  of  Facebook  common  stock  that  were  effectuated  by  the  Company  throughout 
2017, 2018  and  the  first  quarter  of  2019  and  are  presently  ongoing,  during  the  same  time  as 
defendants  Zuckerberg,  Sandberg  and  Koum  sold  more  than  $1  billion  worth  of  their 
personally  held  shares  of  Facebook  common  stock,  in  the  open  market,  and  in  connection  with 
various  transactions  that  were  approved  by  Facebook’s  Board  as  described  herein. 

70.  In  their  positions  as  officers  and  directors  of  Facebook,  each  of  the  Individual 
Defendants  had  access  to  non-public  information  about  the  Company’s  business,  operations, 
corporate  and  financial  affairs,  and  possessed  or  had  knowledge  of  material  non-public 
information  regarding  the  Company. 

71.  By  reason  of  their  positions  as  directors  of  Facebook,  the  Individual  Defendants’ 
ownership  interests  in  Facebook,  their  responsibility  under  the  Company’s  bylaws  for 
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managing  the  company,  their  presumptive  authority  to  sign  key  corporate  documents  including 
Facebook’s  public  filings  with  the  SEC,  their  significant  and  majority  voting  power  by  virtue 
of  their  stock  holdings  and  voting  agreement,  and  their  affiliations  with  venture  capital  firms 
upon  which  Facebook  and  its  subsidiaries  relied  for  financing  and  in  connection  with  acquiring 
various  companies  and  subsidiaries  of  Facebook  including  Oculus  VR,  each  of  the  Individual 
Defendants  possessed  the  power  and  ability  to  directly  or  indirectly  influence  Facebook’s 
corporate  policies  and  decision  making,  including  the  decisions  to  offer  and  sell  and/or 
repurchase  shares  of  Facebook  common  stock  described  herein,  and  did,  directly  or  indirectly, 
exercise  control  over  the  wrongful  acts  detailed  in  this  Complaint. 

72.  Because  of  their  ability  to  control  the  business,  operations,  and  financial  and 
corporate  affairs  of  the  Company,  each  of  the  Individual  Defendants  owed  Facebook  and  its 
shareholders  a  duty  to  exercise  due  care  and  diligence  in  the  management  and  administration  of 
the  affairs  of  the  Company,  including  ensuring  that  Facebook  operated  in  compliance  with  all 
applicable  laws  and  regulations.  Defendants  were  and  are  required  to  act  in  furtherance  of  the 
best  interests  of  Facebook  and  its  shareholders  so  as  to  benefit  all  shareholders  equally  and  not 
in  furtherance  of  the  Defendants’  personal  interest  or  benefit. 

73.  Because  of  their  positions  of  control  and  authority  as  directors  and  officers  of 
Facebook,  the  Defendants  were  able  to  and  did  control  the  general  affairs  of  the  Company  at 
the  time  of  the  violations  of  California  securities  laws  alleged  herein.  Thus,  each  of  the 
Individual  Defendants  participated  in,  and  is  liable  as  a  primary  violator  or  is  jointly  and 
severally  liable,  and/or  is  a  control  person  who  is  subject  to  liability  for  the  primary  violations 
of  California  securities  laws  by  other  Individual  Defendants  who  they  control,  because  they 
possess  the  power  to  directly  or  indirectly  influence  Facebook’s  corporate  policies  and  decision 
making,  including  the  decisions  to  offer  and  sell  and/or  repurchase  shares  of  Facebook 
common  stock. 

74.  The  Individual  Defendants’  conduct  involves  a  knowing  and  culpable  violation  of 
their  obligations  as  directors  and  officers  of  Facebook,  the  absence  of  good  faith  on  their  part, 
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or  a  reckless  disregard  of  their  duties  that  they  were  aware  or  should  have  been  aware  posed  a 
risk  of  serious  injury  to  Facebook.  Each  Individual  Defendant  ratified  each  other’s  misconduct 

because  they  collectively  comprised  Facebook’s  Board  and  management  at  all  relevant  times. 

A.  Control.  Access  and  Authority 

75.  The  Individual  Defendants,  because  of  their  positions  of  control  and  authority, 
were  able  to  and  did,  directly  or  indirectly,  exercise  control  over  the  wrongful  acts  complained 
of  herein,  as  well  as  the  contents  of  the  various  public  statements  issued  by  Facebook. 

76.  Because  of  their  advisory,  executive,  managerial,  and  directorial  positions  with 
Facebook,  each  of  the  Individual  Defendants  had  access  to  adverse,  non-public  information 
about  the  financial  condition,  operations,  and  improper  representations  of  Facebook. 

77.  Each  of  the  Individual  Defendants  was  the  agent  of  each  of  the  other  Individual 
Defendants  and  of  Facebook,  and  was  at  all  times  acting  within  the  course  and  scope  of  such 
agency. 

B.  Conspiracy.  Aiding  and  Abetting,  and  Concerted  Action 

78.  In  committing  the  wrongful  acts  alleged  herein,  the  Individual  Defendants  have 
pursued,  or  joined  in  the  pursuit  of,  a  common  course  of  conduct,  and  have  acted  in  concert 
with  and  conspired  with  one  another  in  furtherance  of  their  wrongdoing.  The  Individual 
Defendants  further  aided  and  abetted  and/or  assisted  each  other  in  breaching  their  respective 
duties. 

79.  The  Individual  Defendants  collectively  and  individually  initiated  a  course  of 
conduct  that  was  designed  to  and  did  conceal  the  fact  that  Facebook’s  data  protection  measures 
were  suffering  from  several  material  security  vulnerabilities  that,  if  exploited,  can  provide 
hackers  with  access  to  sensitive  consumer  data.  In  furtherance  of  this  plan,  conspiracy,  and 
course  of  conduct,  the  Individual  Defendants  collectively  and  individually  took  the  actions  set 
forth  herein. 

80.  The  Individual  Defendants  engaged  in  a  conspiracy,  common  enterprise,  and/or 
common  course  of  conduct.  The  Individual  Defendants  accomplished  their  conspiracy, 
common  enterprise,  and/or  common  course  of  conduct  by  causing  Facebook  to  conceal  from 
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Facebook’s  customers  and  the  investing  public  that  that  Facebook’s  data  protection  measures 
were  suffering  from  several  material  security  vulnerabilities  that,  if  exploited,  can  provide 
hackers  with  access  to  sensitive  consumer  data.  The  Individual  Defendants  also  knew  or 
should  have  known  of  the  Insider  Trading  Defendants’  trading  in  the  Company’s  stock  based 
on  material,  non-public  information  but  failed  to  take  any  action  to  remedy  such  insider-trading 
violations.  Because  the  actions  described  herein  occurred  under  the  authority  of  the  Board, 
each  of  the  Individual  Defendants  was  a  direct,  necessary,  and  substantial  participant  in  the 
conspiracy,  common  enterprise,  and/or  common  course  of  conduct  complained  of  herein. 

81 .  The  purpose  and  effect  of  the  Individual  Defendants’  conspiracy,  common 
enterprise,  and/or  common  course  of  conduct  was,  among  other  things,  to  conceal  from  its 
customers  and  shareholders  the  material  vulnerabilities  in  Facebook’s  data  protection 
measures. 

82.  Each  Individual  Defendant  aided  and  abetted  and  rendered  substantial  assistance 
in  the  wrongs  complained  of  herein.  In  taking  such  actions  to  substantially  assist  the 
commissions  of  the  wrongdoing  complained  of  herein,  each  Individual  Defendant  acted  with 
knowledge  of  the  primary  wrongdoing,  substantially  assisted  the  accomplishment  of  that 
wrongdoing,  and  was  aware  of  his  (or  her)  overall  contribution  to  and  furtherance  of  the 
wrongdoing. 

V.  ALLEGATIONS  ESTABLISHING  PLAINTIFF’S  INDIVIDUAL  RIGHT  TO 
DECLARATORY  RELIEF 

83.  Code  of  Civil  Procedure  section  1060  provides  that  “[a]ny  person  interested 
under  a  written  instrument,  excluding  a  will  or  a  trust,  or  under  a  contract,  or  who  desires  a 
declaration  of  his  or  her  rights  or  duties  with  respect  to  another,  or  in  respect  to,  in,  over  or 
upon  property,  or  with  respect  to  the  location  of  the  natural  channel  of  a  watercourse,  may,  in 
cases  of  actual  controversy  relating  to  the  legal  rights  and  duties  of  the  respective  parties,  bring 
an  original  action  or  cross-complaint  in  the  superior  court  for  a  declaration  of  his  or  her  rights 
and  duties  in  the  premises,  including  a  determination  of  any  question  of  construction  or  validity 
arising  under  the  instrument  or  contract.  He  or  she  may  ask  for  a  declaration  of  rights  or  duties, 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

21 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


3ase  4:18-cv-01792-HSG 


Document  124-2  Filed  08/01/19  Page  28  of  143 


either  alone  or  with  other  relief;  and  the  court  may  make  a  binding  declaration  of  these  rights  or 
duties,  whether  or  not  further  relief  is  or  could  be  claimed  at  the  time.  The  declaration  may  be 
either  affirmative  or  negative  in  form  and  effect,  and  the  declaration  shall  have  the  force  of  a 
final  judgment.”  Civ.  Proc.  Code,  §  1060. 

84.  Plaintiff,  as  a  shareholder  of  Facebook,  has  an  interest  under  Facebook’s  Restated 
Articles  of  Incorporation,  and  desires  a  declaration  of  his  rights  as  a  shareholder  of  Facebook  in 
the  form  of  a  determination  of  a  question  of  validity  arising  under  the  Restated  Articles  of 
Incorporation  as  to  Article  IX.  In  particular,  Plaintiff  seeks  a  declaration  that  a  purported 
forum  selection  clause  in  Article  IX  of  Facebook’s  Restated  Articles  of  Incorporation  is  invalid 
on  its  face,  and  as  applied  to  the  causes  of  action  for  violations  of  the  California  Corporations 
Code  asserted  in  this  Complaint,  and  is  unenforceable  to  the  extent  it  may  be  asserted  as  an 
affirmative  defense  to  this  Complaint  or  any  of  the  causes  of  action  asserted  herein,  or  as  a 
basis  for  dismissal  of  this  Complaint  or  any  of  the  causes  of  action  asserted  herein,  or  would 
prevent  Plaintiff  from  proceeding  in  California  Superior  Court  and  obtaining  a  judgment  from 
this  Court  as  to  violations  of  the  California  Corporations  Code  that  are  alleged  in  the  Second 
through  Fifth  Causes  of  Action  in  this  Complaint. 

85.  A  judicial  determination  of  the  parties’  respective  rights  and  remedies  is 
necessary  and  appropriate  at  this  time  under  the  circumstances  because:  (i)  the  Forum 
Provision  has  been  asserted  by  Facebook  and/or  Individual  Defendants  as  a  defense  to  similar 
derivative  claims  against  Individual  Defendants  under  the  California  Corporations  Code  arising 
from  the  same  facts  and  circumstances  as  this  action,  and  to  obtain  a  dismissal  of  those  claims 
without  prejudice;  (ii)  Facebook’s  Board  approved  Facebook’s  Amended  and  Restated  Bylaws, 
as  amended  and  restated  April  10,  2019,  which  provide  that  the  Forum  Provision  is  subject  to 
modification,  waiver  or  repeal  only  by  Facebook  directors  including  Individual  Defendants; 
and  (iii)  Plaintiff  is  presently  asserting  causes  of  action  under  the  California  Corporations  Code 
derivatively  on  behalf  of  Facebook  against  the  Individual  Defendants,  as  alleged  in  this 
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Complaint,  in  this  California  Superior  Court.  A  judicial  determination  is  necessary  to  prevent 
the  causes  of  action  alleged  herein  from  being  dismissed  on  the  basis  of  the  Forum  Provision. 

86.  Plaintiffs  cause  of  action  for  declaratory  relief  is  brought  individually,  rather 
than  derivatively,  pursuant  to  Delaware  law  holding  that  challenges  to  charter  and  bylaw 
amendments  are  individual  in  nature,  because  when  a  board  takes  actions  “that  diminish  the 
ability  of  non-management  stockholders  to  . . .  amend  the  corporation’s  charter  and  bylaws,  the 
resulting  injury  to  the  non-management  stockholders  is  independent  of  and  distinct  from  any 
injury  to  the  corporation”  and  “is  to  the  stockholders  within  the  corporate  structure  that  have 
lost  relative  power,  not  to  the  corporation  as  an  entity[.]”  See,  e.g.,  In  re  Gaylord  Container 

Corp.  Shareholders  Litig.,  747  A.2d  71,  84  (Del.  Ch.  1999). 

A.  The  Forum  Provision  is  Invalid  and  Unenforceable  in  the  State  of  California 

87.  The  Forum  Provision  is  invalid  and  unenforceable  in  the  State  of  California 

/" 

because  it  “would  substantially  diminish  the  rights  of  California  residents  in  a  way  that  violates 
our  state’s  public  policy.”  Verdugo  v.  Alliantgroup,  L.P.,  237  Cal,App.4th  141, 147  (2015). 

88.  Furthermore,  enforcement  of  the  Forum  Provision  would  be  unreasonable, 
because  the  Delaware  Chancery  Court  would  be  unable  to  accomplish  substantial  justice  as  it 
lacks  jurisdiction  over  the  causes  of  action  under  the  California  Corporations  Code  that  are 
asserted  in  this  Complaint,  and  “parties  may  not  deprive  courts  of  their  jurisdiction  over  causes 
by  private  agreement,”  Korman  v.  Princess  Cruise  Lines,  Ltd.,  32  Cal.App.5th  206,  221  (2019) 
(internal  citations  and  quotations  omitted).  Delaware  has  no  logical  connection  with  the  parties 
or  transactions  alleged  in  this  Complaint. 

89.  Finally,  the  principles  of  comity  and  mutual  regard  for  the  jurisdiction  of 
sovereign  states  allow  a  state  to  apply  its  laws  notwithstanding  that  the  laws  of  another  state 
(Delaware)  have  been  designated  as  governing  by  its  jurisdiction  (or  by  Defendants  under  the 
law  of  its  jurisdiction),  where,  as  here,  the  designation  was  without  legally  valid  consent  under 
the  laws  of  the  other  state  (California).  The  Forum  Provision  is  unconscionable  under 
California  law.  Plaintiff  did  not  consent  to  adoption  of  the  Forum  Provision,  and  Facebook’s 
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minority  shareholders  were  and  are  unable  to  meaningfully  consent  because  they  cannot  vote  to 
modify  or  repeal  the  clause. 

1.  California  Has  a  Strong  Interest  in  Enforcing  Its  Securities  Laws 
That  Significantly  Outweighs  Delaware’s  Attenuated  Interest  in 
General  Governance  Issues  Bearing  No  Connection  to  This  Case 

90.  In  California,  enforcement  of  a  forum  selection  clause  “is  considered 
unreasonable  where  ‘the  forum  selected  would  be  unavailable  or  unable  to  accomplish 
substantial  justice’  or  there  is  no  ‘rational  basis’  for  the  selected  forum.”  Korman,  32 
Cal.App.5th,  at  218  (citing Drulias  v.  1st  Century  Bancshares,  Inc.,  30  Cal.App.5th  696,  707 
(2018)  (internal  quotations  and  citations  omitted).  Facebook’s  Forum  Provision  fails  on  both 
counts. 

91 .  Plaintiff  and  many  of  the  Individual  Defendants  are  California  residents,  and 
Facebook  is  a  corporation  that  is  headquartered  in  California.  California  is  the  location  of  the 
events  in  question,  and  Facebook  has  extensive  ties  to  California,  which  is  where  Facebook 
maintains  its  principal  executive  offices  (in  Menlo  Park)  and  six  other  offices,  including  in 
Fremont,  Los  Angeles,  Mountain  View,  San  Francisco,  Sausalito,  and  Woodland  Hills.  Thus, 
approximately  one-third  of  Facebook’s  U.S.  offices  (seven  out  of  a  total  of  twenty)  are  located 
in  California. 

92.  By  contrast,  not  a  single  one  of  Facebook’s  twenty  U.S.  offices  is  located  in 
Delaware.  Facebook’s  absence  of  connections  to  Delaware,  other  than  as  its  state  of 
incorporation,  confirm  that  enforcement  of  the  Forum  Provision  in  this  case  would  be 
unreasonable,  at  best. 

93.  California  Corporations  Code  sections  25402  and  25403  only  apply  to  sales  of 
securities  in  California,  and  state  and  federal  courts  in  California  have  repeatedly  held  that 
California’s  interest  in  enforcing  its  insider  trading  statutes  supersedes  Delaware’s  interest  in 
overseeing  the  general  internal  governance  of  Delaware  incorporated  companies  where  insider 
trading  has  occurred  in  California.  See,  e.g.,  Friese  v.  Superior  Court,  134  Cal.App.4th  693, 
704-709  (2005)  (explaining  that  California’s  insider  trading  statutes  are  part  of  an  overall 
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scheme  supplementing  the  federal  securities  laws  and  have  broad  implications  of  statewide 
interest  such  that  enforcing  them  does  not  conflict  with  the  internal  affairs  of  a  foreign 
corporation  and  distinguishing  among  other  cases);  Lidow  v.  Superior  Court,  206  Cal.App.4th 
351,  362  (2012)  (discussing  Fries e,  among  other  cases,  and  explaining  that  California  “courts 
are  less  apt  to  apply  the  internal  affairs  doctrine  when  vital  statewide  interests  are  at  stake,  such 
as  maintaining  the  integrity  of  California  security  markets  and  protecting  its  citizens  from 
harmful  conduct”). 

94.  Further,  California  has  a  strong  interest  in  protecting  minority  shareholders 
against  breaches  of  fiduciary  duty  by  majority  shareholders:  “The  increasingly  complex 
transactions  of  the  business  and  financial  communities  demonstrate  the  inadequacy  of  the 
traditional  theories  of  fiduciary  obligations  as  tests  of  majority  shareholders  responsibility  to 
the  minority.  These  theories  have  failed  to  afford  adequate  protection  to  minority 
shareholders. .  .the  comprehensive  rule  of  good  faith  and  inherent  fairness  to  the  minority  in  any 
transaction  where  control  of  the  corporation  is  material  properly  governs  controlling 
shareholders  in  this  state.”  Jones  v.  H.F.  Ahmanson  &  Co.,  460  P.2d  464,  473-474  (Cal.  1969). 
These  interests  are  not  simply  as  between  the  litigants  but  are  a  matter  of  public  policy  in 
California.  See,  e.g.,  Neubauerv.  Goldfarb,  108  Cal.App.4th  47,  56-57  (2003)  (“the  buying 
and  selling  of  corporate  stock  are  transactions  which  affect  a  public  interest”  and  “controlling 
shareholders  possess  a  decisive  advantage  of  bargaining  strength”). 

2.  The  Forum  Provision  Seeks  to  Operate  as  a  Prospective  Waiver  of 
Plaintiffs  Rights  and  Remedies  Under  California  Law  and  Is, 
Therefore,  Against  Public  Policy 

95.  The  Forum  Provision  is  invalid  under  California  law  because  it  impermissibly 
seeks  to  prevent  Plaintiff  (and  Facebook’s  other  minority  shareholders  that  are  similarly 
situated)  from  effectively  vindicating  their  statutory  rights  under  the  California  Corporations 
Code. 

96.  Where,  as  here,  “the  claims  at  issue  are  based  on  unwaivable  rights  created  by 
California  statutes[,]  . . .  the  party  seeking  to  enforce  the  forum  selection  clause  bears  the 
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burden  to  show  litigating  the  claims  in  the  contractually-designated  forum  ‘will  not  diminish  in 
any  way  the  substantive  rights  afforded  . . .  under  California  law.’”  Verdugo  v.  Alliantgroup, 
L.P.,  237  Cal.App.4th  141, 147-148  (2015).  Defendants  cannot  satisfy  their  burden  here. 

97.  If  enforced,  the  Forum  Provision  would  bar  Plaintiff  from  asserting  the  causes  of 
action  in  this  Complaint  because  the  Delaware  Chancery  Court  does  not  have  subject-matter 
jurisdiction  over  statutory  claims,  and  personal  jurisdiction  is  also  potentially  lacking  in  the 
Delaware  Chancery  Court  as  to  Plaintiff  and  certain  Individual  Defendants.  The  Forum 
Provision  therefore  seeks  to  operate  as  a  “choice  of  law”  provision,  and  as  a  prospective  waiver 
of  Plaintiff  s  rights  to  pursue  claims  and  remedies  under  California  law,  including  in  a 
derivative  action  on  behalf  of  Facebook. 

98.  The  Forum  Provision  acts  as  a  waiver  of  the  protections  that  California  law 
provides  for  its  residents,  and  for  non-residents,  from  market  manipulation,  false  and 
misleading  statements  and  insider  trading,  among  other  things,  as  set  forth  in  the  Corporations 
Code  sections  that  Defendants  are  alleged  to  have  violated  in  this  Complaint. 

99.  Moreover,  a  choice  of  jurisdiction  and  law  should  bear  a  reasonable  nexus  to  the 
parties  and  the  transaction.  Here,  it  does  not.  Delaware’s  interest  in  enforcing  general 
corporate  governance  matters  does  not  bear  any  nexus  to  the  particular  parties  and  the 
transaction  giving  rise  to  the  causes  of  action  asserted  in  this  Complaint. 

100.  California  courts  have  held  that  “Delaware’s  interest  in  regulating  the  activities  of 
its  domestic  corporations  is  less  substantial  where,  as  here,  its  only  contact  with  the  corporation 
is  in  issuing  a  certificate  of  incorporation.”  Havlicek  v.  Coast-to-Coast  Analytical  Servs.,  Inc., 
39  Cal.  App.  4th  1844, 1852  (1995)  (applying  California  law  to  the  inspection  demand  of  a 
shareholder  of  a  Delaware  corporation). 

101 .  Further,  as  fiduciaries  under  California  law,  majority  shareholders  “may  not  use 
their  power  to  control  corporate  activities  to  benefit  themselves  alone  or  in  a  manner 
detrimental  to  the  minority.”  Ahmanson,  460  P.2d  464  at  471.  California  courts  have 
concluded  that  the  fiduciary  duty  imposed  upon  majority  shareholders  limits  their  exercise  of 
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contractual  rights,  and  that  such  limitations  are  a  fundamental  public  policy.  Thrasher  v. 
Thrasher,  27  Cal.App.3d  23,  26-27  (1972)  (“the  established  requirement  of  scrupulous  fairness 
permits  inquiry  into  the  motives  and  purpose  of  the  dominant  shareholder  in  his  enforcement  of 
[contractual]  repayment  otherwise  properly  recoverable  by  him”);  Neubauer,  108  Cal.  App.  4th 
at  57  (“We  conclude,  therefore,  waiver  of  corporate  directors’  and  majority  shareholders’ 
fiduciary  duties  to  minority  shareholders  in  private  close  corporations  is  against  public  policy 
and  a  contract  provision  in  a  buy-sell  agreement  purporting  to  effect  such  a  waiver  is  void”). 

102.  California’s  interest  in  protecting  the  rights  of  minority  shareholders,  and  its 
residents,  trumps  whatever  interest  Delaware  might  have  in  providing  a  forum  for  derivative 
actions  or  in  supplying  the  rule  of  decision,  especially  where  (as  here)  it  necessarily  would 
apply  to  the  exclusion  of  applicable  California  law  that  provides  for  different  and  additional 
remedies  beyond  what  could  be  obtained  in  a  shareholder  derivative  action  asserting  only 
claims  under  Delaware  law. 

103.  Delaware  has  no  interest  in  preventing,  and  Delaware  law  does  not  permit 
adoption  of  a  Forum  Provision  that  seeks  to  prevent,  a  shareholder  derivative  action  seeking 
remedies  for  the  Company  when  it  is  expressly  authorized  by  California  law  and  is  not 
inconsistent  with  Delaware  law.  This  is  especially  true  where  (as  here)  the  Individual 
Defendants  adopted  and  are  maintaining  the  Forum  Provision  that  impermissibly  seeks  to 
prevent  the  derivative  claims  from  being  brought  in  any  forum  based  solely  on  their  own 
disloyal,  self-interested  purposes. 

104.  The  implied  derogation  of  applicable  laws  governing  securities  transactions  in  the 
State  of  California  that  the  Forum  Provision  seeks  to  impose  is  contrary  to  California’s 
overriding  interests  in  preventing  securities  fraud  by  corporations  that  are  headquartered  in  the 
State  of  California,  especially  where  (as  here),  the  wrongful  conduct  alleged  was  committed  in 
or  emanated  from  the  State  of  California,  the  owner  of  a  majority  of  the  voting  shares  of 
Facebook  stock  is  a  California  resident  (defendant  Zuckerberg),  and  the  Company  has  clearly 
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availed  itself  of  the  benefits  and  advantages  of  California’s  laws  by  doing  business  in 
California. 

105.  By  contrast,  Facebook  has  minimal  or  no  meaningful  connections  to  Delaware 
besides  its  incorporation  under  the  laws  of  that  state. 

3.  The  Forum  Provision  is  Unconscionable  Because  Plaintiff  Did  Not 
Consent  to  Its  Adoption  and  Facebook’s  Minority  Shareholders 
Cannot  Vote  to  Modify  or  Repeal  the  Provision 

106.  The  Board’s  unilateral  decision  to  adopt  and  maintain  the  Forum  Provision  that 
exceeds  the  scope  of  the  applicable  Delaware  statute  is  clearly  the  product  of  overreaching  and 
a  violation  of  the  Individual  Defendants’  fiduciary  duties.  It  would,  therefore,  be  inequitable  to 
enforce  the  Forum  Provision  under  both  Delaware  and  California  law. 

1 07.  Enforcement  of  the  Forum  Provision  would  be  unreasonable  as  it  is 
unconscionable  under  California  law.  The  Forum  Provision  was  unilaterally  adopted  by 
Facebook’s  Board  and  is  subject  to  modification,  waiver  or  repeal  only  by  Facebook  directors 
including  Individual  Defendants,  pursuant  to  Facebook’s  Amended  and  Restated  Bylaws,  as 
amended  and  restated  April  10,  2019,  which  Facebook’s  Board  adopted  and  approved  on  or 
about  April  10,  2019. 

1 08.  The  Forum  Provision  and  related  bylaws  prevent  Facebook’s  minority 
shareholders  from  voting  to  modify  or  repeal  the  Forum  Provision,  and  are  procedurally 

'N 

unconscionable  because  they  were  adopted  and  approved  by  Facebook’s  Board  and  are 
maintained  by  the  Board  without  the  consent  of  Plaintiff.  California  state  and  federal  courts 
have  held  that  such  a  lack  of  consent  is  sufficient,  on  its  own,  to  invalidate  or  decline  to  enforce 
a  contractual  provision  that  designates  a  particular  forum  for  litigation  of  disputes  arising  under 

the  contract.  See,  e.g.,  Galaviz  v.  Berg,  763  F.Supp.2d  1170  (N.D.  Cal.  201 1)  (denying  motion 

/ 

to  dismiss  on  the  basis  of  a  forum  selection  clause  that  was  unilaterally  adopted  by  the  ' 
corporation’s  board  of  directors  in  amended  bylaws  without  shareholder’s  consent,  noting  that 
while  a  party’s  acceptance  of  an  agreement  may  “serve  as  consent  to  all  the  terms  therein, 
whether  or  not  all  of  them  were  specifically  negotiated  or  even  read,”  a  party  may  not 
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independently  amend  or  alter  the  provisions  of  a  contract  after  the  contract  has  been  entered 
into,  and  finding  that  corporation  had  otherwise  failed  to  demonstrate  the  effectiveness  of  its 
forum  selection  bylaw  to  restrict  the  plaintiffs  from  pursuing  their  claims  in  the  California 
federal  court). 

109.  In  Tech.  Credit  Corp.  v.  N.J.  Christian  Academy,  Inc.,  for  example,  a  federal 
court  in  California  concluded  that  a  forum  selection  clause  was  not  enforceable  because  the 
individual  against  whom  enforcement  was  sought  had  not  signed  the  agreement  containing  the 
clause,  explaining,  “defendants  have  not  cited  authority  addressing  the  circumstances  presented 
here — where  one  side  seeks  to  enforce  a  forum  selection  clause  in  a  contract  (not  at  issue) 
against  a  non-signatory  who  seeks  to  enforce  a  competing  forum  selection  clause  in  a  different 
contract  that  is  at  issue.”  2018  WL  1863358,  at  *13  (N.D.  Cal.  Apr.  18, 2018).  Here,  as  in 
Tech.  Credit  Corp.,  Plaintiff  is  not  a  signatory  to  the  Restated  Articles  of  Incorporation. 

Further,  given  the  existence  of  other  potentially  other  forum  selection  clauses  that  Facebook 
has  argued  make  California  the  proper  venue  for  similar  claims,  the  Forum  Provision  should 
not  be  enforced  in  this  case. 

110.  Facebook’s  minority  shareholders  (including  Plaintiff)  cannot  (and  did  not) 
meaningfully  consent  to  the  Forum  Provision.  Facebook’s  minority  shareholders  are  unable  to 
vote  or  obtain  shares  of  Facebook  Class  C  stock  that  are  necessary  to  vote,  due  to  Facebook’s 
stock  class  structure  and  defendant  Zuckerberg’s  majority  voting  power.  Thus,  Facebook’s 
minority  shareholders  (including  Plaintiff)  were  and  are  deprived  of  any  meaningful  choice  as 
to  whether  to  adopt  or  maintain  the  Forum  Provision,  because  they  cannot  vote  to  repeal  or 
modify  the  Forum  Provision;  only  Defendants  can. 

111.  Further,  the  Forum  Provision  is  substantively  unconscionable  because  the 
provision  at  issue  reallocates  risks  in  an  objectively  unreasonable  manner  by  placing  all  of  the 
risk,  i.e.,  liability  for  statutory  violations  committed  by  officers  and  directors  of  Facebook,  on 
Facebook  and  its  shareholders,  and  by  eliminating  the  risk  to  officers  and  directors  of  Facebook 
that  they  may  be  held  personally  liable  for  damages  and  other  statutory  remedies,  including 
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under  the  California  Corporations  Code.  The  Forum  Provision  is,  therefore,  unreasonably 
favorable  to  the  Individual  Defendants  because  it  would  allow  them  to  avoid  personal  liability 

to  Facebook  and  its  shareholders  for  the  violations  of  law  alleged  herein. 

B.  The  Forum  Provision  Is  Invalid  and  Unenforceable  Under  Delaware  Law 

112.  The  Delaware  Chancery  Court  explained  in  Boilermakers  Local  154  Retirement 
Fund  v.  Chevron  Corp.  that  “if  a  plaintiff  believes  that  a  forum  selection  clause  cannot  be 
equitably  enforced  in  a  particular  situation,  the  plaintiff  may  sue  in  her  preferred  forum  and  . . . 
argu[e]  that,  under  [M/S Bremen  v.  Zapata  Off-Shore  Co.,  407  U.S.  1, 12  (1972)],  the  forum 
selection  clause  should  not  be  respected  because  its  application  would  be  unreasonable.  The 
plaintiff  may  also  argue  that,  under  [Schnell  v.  Chris-Craft  Industries,  Inc.,  285  A.2d  437, 439 
(Del.  1971)],  the  forum  selection  clause  should  not  be  enforced  because  the  bylaw  was  being 
used  for  improper  purposes  inconsistent  with  the  directors’  fiduciary  duties. . .”  73  A.3d  934, 
958—63  (Del.  Ch.  2013),  judgment  entered  sub  nom.  Boilermakers  Local  154  Ret.  Fund  &  Key 
W.  Police  &  Fire  Pension  Fund  v.  Chevron  Corp.  (Del.  Ch.  2013).  Here,  Plaintiff  seeks  a 
declaratory  judgment  that  Facebook’s  Forum  Provision  should  not  be  respected  because  its 
application  would  be  unreasonable,  and  Defendants’  adoption  and/or  refusal  to  grant  a  waiver 
of  the  Forum  Provision  constitutes  a  breach  of  their  fiduciary  duties  to  Facebook  and  its 
shareholders. 

1.  The  Forum  Provision  is  Facially  Invalid  Because  It  Exceeds  the  Scope 
of  the  Delaware  Statute  and  Impermissibly  Seeks  to  Regulate  Other 
Matters  That  Are  Not  “Internal  Affairs” 

113.  Facebook’s  Forum  Provision  is  invalid  on  its  face  because  it  does  not  comply 
with  section  1 15  of  the  Delaware  General  Corporation  Law,  which  allows  a  board  of  directors 
of  a  Delaware  corporation  to  amend  or  adopt  a  corporate  charter  provision  or  bylaw  to  include 
a  provision  requiring  that  lawsuits  asserting  “internal  corporate  claims”  must  be  brought  in  a 
court  in  the  State  of  Delaware;  however,  the  statute  specifically  limits  the  permissible  scope  of 
any  such  provision  to  include  “internal  corporate  claims”  -  i.e.,  claims  involving  the  internal 
affairs  of  the  corporation.  Del.  Code  tit.  8,  §  1 15.  The  term  “internal  corporate  claims”  is 
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defined  to  mean  claims,  including  claims  in  the  right  of  the  corporation,  (1)  that  are  based  upon 
a  violation  of  a  duty  by  a  current  or  former  director  or  officer  or  stockholder  in  such  capacity, 
or  (2)  as  to  which  the  DGCL  confers  jurisdiction  upon  the  Court  of  Chancery.  Id. 

1 14.  Facebook’s  Forum  Provision  is  facially  invalid  under  Delaware  law  because  it 
goes  beyond  the  scope  of  the  statute  and  impermissibly  seeks  to  regulate  the  Company’s 
“internal  affairs”  -  and  to  regulate  Facebook’s  external  relationships  and  claims  under 
California  law.  And,  it  goes  even  further,  because  if  enforced,  the  Forum  Provision  would 
foreclose  and  prevent  entirely  any  derivative  claims  under  California  statutes  (and  federal 
statutes)  that  (among  other  things)  are  properly  applicable  to  the  securities  transactions  alleged 
to  violate  the  Corporations  Code. 

115.  In  Sciabacucchi  v.  Salzberg  CA,  the  Delaware  Chancery  Court  held  that  a  forum 
selection  provision  contained  in  the  certificate  of  incorporation  of  a  Delaware  corporation  is 
invalid  to  the  extent  it  seeks  to  “use  corporate  law  to  regulate  the  corporation’s  external 
relationships”  -  i.e.,  a  claim  that  “does  not  turn  on  the  rights,  powers,  or  preferences  of  the 
shares,  language  in  the  corporation’s  charter  or  bylaws,  a  provision  in  the  DGCL,  or  the 
equitable  relationships  that  flow  from  the  internal  structure  of  the  corporation.”  Sciabacucchi 
v.  Salzberg ,  2018  WL  6719718,  at  *203  (Del.  Ch.  Dec.  19,  2018),  appeal  dismissed ,  204  A.3d 
841  (Del.  2019). 

116.  The  court  in  Sciabacucchi  explained  that  claims  under  the  Securities  Act  of  1933 
are  “external”  claims  because  federal  law,  not  Delaware  law,  creates  the  claim,  defines  the 
elements  of  the  claim  and  specifies  who  can  be  a  plaintiff  or  a  defendant.  And  a  forum 
selection  clause  that  seeks  to  regulate  such  external  claims  is  invalid,  because  a  corporation’s 
“state  of  incorporation  cannot  use  corporate  law  to  regulate  the  corporation’s  external 
relationships.”  Id.  at  *20.  Accordingly,  the  court  held  that  a  “charter-based  forum-selection 
provision”  of  a  Delaware  corporation  cannot  govern  claims  brought  under  the  federal  1933  Act 
“because  the  provision  would  not  be  addressing  ‘the  rights  and  powers  of  the  plaintiff- 
stockholder  as  a  stockholder.’” 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

31 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


3ase  4:18-cv-01792-HSG 


Document  124-2  Filed  08/01/19  Page  38  of  143 


117.  The  causes  of  action  under  the  Corporations  Code  alleged  herein  are  created  by 
California  law,  and  Facebook’s  Forum  Provision  impermissibly  seeks  to  regulate  Facebook’s 
“external  claims”  and  to  prevent  such  claims  from  being  brought  in  any  forum,  as  is  clear  from 
the  fact  that  the  Delaware  Chancery  Court  has  no  jurisdiction  over  federal  claims.  As  the 
Delaware  Chancery  Court  held  in  Sciabacucchi,  “The  constitutive  documents  of  a  Delaware 
corporation  cannot  bind  a  plaintiff  to  a  particular  forum  when  the  claim  does  not  involve 
rights  or  relationships  that  were  established  by  or  under  Delaware’s  corporate  law.  In 
this  case,  the  []  Forum  Provisions  attempt  to  accomplish  that  feat.  They  are  therefore 
ineffective  and  invalid.”  Id.  at  *3  (emphasis  added).  The  same  is  true  here. 

118.  Facebook’s  Forum  Provision  is  further  invalid  as  applied  to  the  extent 
Defendants  may  seek  enforcement  as  to  the  causes  of  action  for  violations  of  the  California 
Corporations  Code  alleged  herein,  because  the  Delaware  Court  of  Chancery  is  not  an  adequate 
alternative  forum,  as  it  does  not  have  jurisdiction  over  Plaintiffs  claims  under  California  law. 

2.  The  Forum  Provision  is  Invalid  “As  Applied”  to  This  Action  Because 
the  Delaware  Chancery  Court  Lacks  Jurisdiction 

119.  The  Forum  Provision  by  its  own  terms  only  allows  for  Delaware’s  jurisdiction  to 
the  extent  “permitted  by  law.”  And  section  1 1 5  of  the  DGCL  “properly  confirms  that  despite 
authorizing  the  inclusion  of  forum-selection  bylaws  in  the  constitutive  documents  of  a 
corporation,  those  provisions  operate  ‘consistent  with  applicable  jurisdictional  requirements.’” 
In  re  Pilgrim ’s  Pride  Corporation  Derivative  Litigation,  2019  WL  1224556,  at  *14  (Del.  Ch. 
Mar.  19,  2019)  (quoting  8  Del.  C.  §  115).  Furthermore,  as  the  Delaware  Chancery  Court 
recently  noted,  “[i]t  is  not  clear  . . .  that  buying  or  continuing  to  hold  shares  in  a  Delaware 
corporation  with  an  exclusive-forum  provision  would  constitute  a  sufficient  degree  of  consent 
to  imbue  this  court  with  the  power  to  exercise  personal  jurisdiction  over  a  stockholder  who  has 
no  other  ties  to  Delaware  and  did  not  otherwise  participate  in  the  adoption  of  the  forum- 
selection  clause.”  In  re  Pilgrim ’s  Pride,  2019  WL  1224556,  at  *14. 

120.  While  Facebook’s  Forum  Provision  effectively  seeks  to  operate  as  a  choice  of 
law  provision,  it  does  not  provide  that  the  underlying  allegations  in  this  case  “are  expressly 
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provided”  by  Delaware  law,  nor  does  it  provide  an  adequate  forum  in  “federal  or  state  courts”  - 
despite  Defendants’  clearly  being  aware  that  this  is  the  only  appropriate  way  that  such  a  clause 
could  operate  consistent  with  principles  of  sovereignty  and  comity  under  the  laws  of  either 
state.  This  further  demonstrates  that  Facebook’s  Board  intentionally  adopted  and  has  failed  to 
modify  the  Forum  Provision  for  the  improper  purpose  of  foreclosing  a  federal  forum  that  would 
have  jurisdiction  over  a  far  wider  scope  of  claims  that  may  be  brought  derivatively  on  behalf  of 
Facebook  against  its  officers  and  directors,  i.e.,  the  Individual  Defendants. 

121.  Indeed,  in  Boilermakers,  the  Delaware  Chancery  Court  noted  that  it  had  declined 
to  enforce  a  forum  selection  clause  designating  it  as  the  exclusive  forum  for  a  contract  dispute 
in  the  TransAmerican  Natural  Gas  case,  because  it  “did  not,  as  a  matter  of  positive  Delaware 
law,  have  subject  matter  jurisdiction  over  the  controversy.”  Boilermakers,  73  A.3d  at  959.  On 
appeal,  the  Delaware  Supreme  Court  affirmed  the  Chancery  Court’s  holding  that  the  litigation 
could  proceed  in  the  forum  that  the  plaintiff  in  the  non-Delaware  action  had  chosen,  which  was 
a  court  of  general  jurisdiction.  Id. 

122.  As  alleged  herein,  Facebook’s  Forum  Provision  does  not  provide  a  forum  for  a 
shareholder  to  bring  a  derivative  action  asserting  statutory  claims.  Accordingly,  the  Forum 
Provision  cannot  be  equitably  enforced  in  this  particular  situation.  Facebook  cannot  assert  an 
exclusive  contractual  and  legal  right  to  litigate  claims  in  a  forum  that  lacks  jurisdiction  over 
them.  See  Helix  Generation  LLC,  2019  WL  2068659,  at  *1  (“As  a  cat  may  look  at  a  king,  so 
too  may  the  parties  to  a  contract  agree  to  litigate  disputes  in  any  court  they  wish;  such  election 
may  bind  the  parties,  but  can  never  bind  a  court,  and  cannot  satisfy  the  jurisdictional 
requirements  of  this  Court  of  limited  jurisdiction.”)  (finding  parties’  contractual  agreement  was 
insufficient  to  confer  jurisdiction  in  the  Court  of  Chancery). 

123.  In  addition,  Facebook  recently  filed  a  motion  to  dismiss  the  Washington  D.C. 
Attorney  General  complaint  alleging  that  Facebook’s  policies  violate  the  D.C.  Consumer 
Protection  Procedures  Act,  arguing  that  “mere  use  of  a  website”  is  not  enough  for  a  federal 
court  to  exercise  personal  jurisdiction  over  an  internet  company  like  Facebook.  See  District  of 
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Columbia  v.  Facebook,  Inc Civil  Action  No.  2018  CA  008715  B,  Defendant  Facebook,  Inc.’s 
Opposed  Motion  to  Dismiss  or,  in  the  Alternative,  Stay  Proceedings  (filed  Feb.  1,  2019),  at  1 . 
Facebook  also  argued  that  that  the  U.S.  District  Court  for  the  District  of  Columbia  also  lacks 
jurisdiction  because  “the  consumer  contracts  underlying  the  District’s  allegations  are  expressly 
governed  by  California  law,  not  D.C.  law.”  Id.  at  1 1  (“Indeed,  as  courts  in  the  District  have 
recognized,  Facebook’s  user  agreements  provide  “a  particularly  weak  justification  for  invoking 
the  D.C.  long-arm  statute  [under  Section  (a)(2)],”  because  “‘[b]y  [their]  terms,  [California]  law 
governs,  and  any  litigation  shall  be  brought  in  the  federal  or  state  courts  in  [California].’”) 
(citation  omitted)  (alterations  in  original).  While  Facebook’s  motion  to  dismiss  was  denied  on 
May  30,  2019,  its  arguments  demonstrate  that  jurisdiction  in  Delaware  Chancery  Court  is  far 
from  certain. 

3.  Facebook’s  Board  Adopted  and  Maintains  the  Forum  Provision  for 

Self-Interested  and  Disloyal  Purposes,  and  Its  Enforcement  Would  Be 
Inequitable  and  Is  Not  Permitted  by  Delaware  Law 

124.  The  Forum  Provision  was  adopted,  has  not  been  waived  or  modified  and/or  is 
maintained  by  Facebook’s  Board,  including  Individual  Defendants  who  are  directors,  for  self- 
interested  and  disloyal  purposes  that  are  inconsistent  with  their  fiduciary  duties  owed  to 

Facebook  and  its  minority  shareholders.  The  Forum  Provision  cannot  be  equitably  enforced 

/• 

because  it  was  adopted  and  affirmatively  approved  and  is  maintained  by  Facebook’s  Board  for 
such  improper  purposes  in  violation  of  their  fiduciary  duties  owed  to  Facebook. 

125.  The  Forum  Provision  was  expressly  or  tacitly  approved  by  Facebook’s  Board 
through  its  adoption  of  Facebook’s  Amended  and  Restated  Bylaws,  as  amended  and  restated 
April  10, 2019,  which  Facebook’s  Board,  including  Individual  Defendants  who  are  directors, 
adopted  and/or  approved  for  an  improper  purpose  that  is  inconsistent  with  their  fiduciary  duties 
and  which  constitutes  a  breach  of  their  fiduciary  duties  owed  to  Facebook  and  its  minority 
shareholders.  Facebook’s  Amended  and  Restated  Bylaws  do  not  modify  or  allow  for 
modification  of  the  Forum  Provision  and  impose  certain  requirements  that  must  be  met  in  order 
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to  modify  the  Forum  Provision  that  prevent  Plaintiff  and  Facebook’s  minority  shareholders 
from  voting  to  modify  the  Forum  Provision. 

126.  The  Forum  Provision  seeks  to  prevent  derivative  claims  arising  under  any  state  or 
federal  statute  from  being  brought  in  any  forum,  including  in  the  Delaware  Chancery  Court. 
Accordingly,  Defendants  would  have  the  Forum  Provision  apply  to  actions  and  claims  over 
which  the  Delaware  Chancery  Court  does  not  have  jurisdiction,  thus  foreclosing  such  claims 
from  ever  being  brought  derivatively  on  behalf  of  Facebook,  in  any  forum. 

127.  It  is  clear  that  by  adopting  and  maintaining  the  Forum  Provision,  Defendants 
seek  only  to  avoid  their  own  personal  liability,  as  Facebook’s  Forum  Provision  purports  to 
apply  broadly  to  “any  action  asserting  a  claim  of . . .  wrongdoing  by[]  any  director,  officer, 
employee  or  agent  of  [Facebook] ...”  (Emphasis  added). 

128.  Moreover,  the  California  statutes  alleged  herein  (and  other  statutes  under  various 
state  and  federal  laws)  provide  for  different  and  additional  remedies  that  would  result  in  a 
greater  recovery  for  Facebook  than  could  be  obtained  in  a  derivative  action  asserting  only 
claims  under  Delaware  law.  As  one  federal  court  noted,  “there  is  no  blanket  prohibition  on  the 
applicability  of  multiple  state  securities  law  to  a  single  transaction.”  Silvercreek  Management, 
Inc.  v.  Citigroup,  Inc.,  248  F.Supp.3d  428,  455  (S.D.N.Y.  2017)  (citing  69A  Am.  Jur.  2d 
Securities  Regulations — State  §  18)  (‘“In  the  area  of  securities  transactions,  no  conflict-of  laws 
analysis  ordinarily  applies,  and  all  of  the  blue  sky  laws  of  all  of  the  jurisdictions  apply  to  the 
transactions  that  are  within  the  bounds  of  the  statute.’”). 

129.  By  adopting  and  maintaining  the  Forum  Provision  that  seeks  to  prevent  causes  of 
action  under  the  California  Corporations  Code  (among  other  laws)  from  being  brought  in  a 
derivative  action  on  Facebook’s  behalf,  solely  because  of  the  directors’  own  self-interest  in 
avoiding  personal  liability  to  the  Company,  and  by  placing  the  risk  of  liability  for  violations  of 
state  and  federal  securities  laws  solely  on  Facebook,  Facebook’s  Board  has  failed  to  act  in 
accordance  with  its  fiduciary  duties  owed  to  Facebook  under  Delaware  law.  Accordingly,  the 
Forum  Provision  is  unenforceable  under  Delaware  law. 

VI.  ALLEGATIONS  ESTABLISHING  DEFENDANTS  ’  LIABILITY  FOR 
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VIOLATIONS  OF  THE  CALIFORNIA  SECURITIES  LAWS 
A.  Background  of  the  Company  and  its  Business 

1 30.  Facebook  was  founded  in  2004  by  defendant  Zuckerberg  while  he  was  a  student 
at  Harvard  University.  Today,  Facebook  operates  the  world’s  leading  social  media  website, 
www.facebook.com,  which  attracts  over  2  billion  daily  users  from  across  the  globe,  including 
214  million  daily  users  in  the  United  States  alone.  Although  Facebook’s  users  are  critical  to 
the  Company’s  business,  they  are  not  its  customers  or  the  source  of  its  revenue;  Facebook  is 
essentially  an  advertising  company  that  connects  its  customers  -  sellers  and  advertisers  of 
consumer  goods  and  services  -  with  its  users,  generating  revenue  primarily  through  the  sale  of 
advertisements  that  are  targeted  to  Facebook  users  based  on  their  demographics  and  various 
other  information. 

131.  Facebook  does  not  provide  investors  with  segmented  information  about  how  the 
various  platforms  it  operates  are  performing.  Instead,  Facebook’s  reports  publicly  filed  with 
the  SEC  state:  “Our  chief  operating  decision-maker  is  our  Chief  Executive  Officer  who  makes 
resource  allocation  decisions  and  assesses  performance  based  on  financial  information 
presented  on  a  consolidated  basis.  There  are  no  segment  managers  who  are  held  accountable  by 
the  chief  operating  decision-maker,  or  anyone  else,  for  operations,  operating  results,  and 
planning  for  levels  or  components  below  the  consolidated  unit  level.  Accordingly,  we  have 
determined  that  we  have  a  single  reportable  segment  and  operating  unit  structure.” 

1 32.  Facebook’s  success  is  driven  by  the  Company’s  possession  of  the  data  uploaded 
to  its  platform  by  billions  of  Facebook  users.  Facebook  requires  users  to  register  and  create  a 
personal  profile  before  they  can  join  the  website’s  “social  network”  and  interact  with  other 
users,  who  they  can  add  as  friends.  Facebook  users  may  join  user  groups,  message  each  other, 
and  post  status  updates  or  other  content  that  can  be  viewed  by  other  Facebook  users  and  shared 
with  their  friends.  Facebook  users  can  also  interact  with  a  wide  selection  of  applications 
including  social  games  or  other  services  like  the  photo-sharing  app  Instagram.  By  doing  so, 
Facebook  users  provide  their  personal  information  to  Facebook,  including  not  just  their 
demographic  and  personal  information,  but  also  the  people  they  have  “friended,”  the  pages  and 
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posts  they  have  visited,  and  those  that  they  have  “followed”  or  “liked.”  Together,  this  data 
gives  Facebook,  and  marketers  in  general,  insight  into  the  products  or  services  that  would 
interest  a  particular  user.  This  information  allows  Facebook  to  target  and  market  advertising  to 
users  most  likely  to  purchase  their  products  and  services,  giving  Facebook’ s  targeting 
advertising  business  a  significant  advantage  over  traditional  advertising,  and  generating  billions 
of  dollars  in  revenue  for  Facebook. 

1.  Facebook’s  Advertising  Business  is  the  Source  of  Substantially  All  of 
Its  Revenue 

133.  Facebook  generates  revenue  by  selling  advertisement  placements  over  its  website 
and  mobile  applications  to  sellers  of  consumer  goods  and  services  to  help  them  reach 
consumers  on  the  website  based  on  user  data  appropriated  by  Facebook. 

1 34.  Facebook  offers  advertising  services  to  its  customers  that  include  or  have 
included  at  various  points  in  time,  among  other  things,  assisting  customers  in  developing  and 
creating  advertisements  and  advertising  strategies,  obtaining  information  about  Facebook  users 
from  the  Company’s  website  and  third  party  sources,  compiling  user  data  and  maintaining 
databases  of  information  about  Facebook  users,  developing  a  marketing  and  advertising 
strategy  to  target  and  exclude  certain  groups  of  Facebook  users  from  receiving  advertisements, 
tracking  and  evaluating  the  effectiveness  of  advertisements  and  user  targeting  strategies, 
implementing  advertising  campaigns,  and  delivering  advertisements  to  Facebook  users, 
including  via  News  Feed. 

135.  Facebook’s  customers  (advertisers)  can  use  Facebook’s  targeted  advertising 
services  to  direct  their  ads  to  users  with  specific  attributes.  Facebook  applies  its  own  algorithm 
to  categorize  Facebook  users  and  to  determine  which  users  and  groups  of  users  will  be  targeted 
to  receive  advertisements  via  its  advertising  platform.  As  stated  on  Facebook’s  website:  “With 
our  powerful  audience  selection  tools,  you  can  target  people  who  are  right  for  your  business. 
Using  what  you  know  about  your  customers — like  demographics,  interests  and  behaviors — you 
can  connect  with  people  similar  to  them.” 
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136.  Facebook  also  provides  detailed  analytical  data  to  advertisers  on  how  their  ad 
campaigns  are  performing,  including  among  certain  groups  of  Facebook  users  with  specified 
attributes  and  characteristics  that  the  advertiser  seeks  to  target.  By  monitoring  this  data  and 
providing  this  information  to  its  customers  on  an  ongoing  basis,  Facebook  captures  consumer 
behavior,  profile,  preferences,  lifestyle,  and  other  attributes  which  allow  Facebook  to  run 
targeted  ads.  This  enables  advertisers  to  specify  the  groups  of  users  that  will  be  targeted  to 
receive  the  advertisements. 

137.  Facebook’s  advertising  business  accounts  for  substantially  all  of  the  Company’s 
revenue,  as  shown  by  the  below  chart: 


138.  Given  the  importance  of  user  data  to  the  success  of  the  Company’s  targeted 
advertisements,  Facebook’s  financial  performance  depends  on  its  success  in  attracting  active 
users  to  its  platform.  As  the  Company  acknowledged  in  its  FY17  Form  10-K:  “The  size  of  our 
user  base  and  our  users'  level  of  engagement  are  critical  to  our  success.  Our  financial 
performance  has  been  and  will  continue  to  be  significantly  determined  by  our  success  in 
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adding,  retaining,  and  engaging  active  users  of  our  products,  particularly  for  Facebook  and 
Instagram.” 

139.  To  provide  investors  with  insight  into  user  engagement,  Facebook  regularly 
reports  the  average  number  of  daily  active  users  (“DAUs”)  and  monthly  active  users  (“MAUs”) 
on  its  platform.  As  of  December  31,  2017,  Facebook  reported  1 .4  billion  DAUs  and  2.13 
billion  MAUs,  both  of  which  it  said  represented  14%  growth  over  the  prior  year.  According  to 
its  FY17  Form  10-  K,  the  Company  “view[s]  DAUs  and  DAUs  as  a  percentage  of  MAUs,  as 
measures  of  user  engagement.”  DAUs  and  MAUs,  along  with  average  revenue  per  user 
(“ARPU”)  are  identified  in  Facebook’s  annual  reports  as  the  key  metrics  by  which  the 
Company  measures  the  success  of  its  business  plan. 

140.  In  addition  to  measuring  user  engagement  in  the  aggregate,  Facebook  has  created 

i' 

it 

a  sophisticated  system  for  monitoring  granular  data  about  users’  engagement  with  Facebook’s 
platform,  such  as  any  action  a  user  takes  reacting  to,  commenting  on  or  sharing  an  ad,  claiming 
an  offer,  viewing  a  photo  or  video,  or  clicking  on  a  link.  Defendants  encourage  their  customers 
to  review  these  metrics  when  making  business  decisions,  and,  because  customers  do,  the 
Executive  Defendants  paid  close  attention  to  and  continuously  improved  these  metrics. 

2.  Facebook’s  Platform  Was  Designed  to  Allow  “Reciprocal”  Access  to 
User  Data 

141.  The  Facebook  Platform  was  launched  in  2007.  The  platform  originally 
supported  only  applications  created  by  Facebook  for  use  on  Facebook,  but  soon  expanded  to 
allow  third  party  developers  to  develop  their  apps  using  the  Facebook  Platform.  Defendant 
Zuckerberg  announced  the  expansion  of  the  platform  to  third  party  developers  in  2008,  stating: 
“With  this  evolution  of  Facebook  Platform,  we’ve  made  it  so  that  any  developer  can  build  the 
same  applications  that  we  can.  And  by  that,  we  mean  that  they  can  integrate  their  application 
into  Facebook  — into  the  social  graph  —  the  same  way  that  our  applications  like  Photos  and 
Notes  are  integrated.” 

142.  In  a  further  expansion  of  the  platform,  in  2010,  defendant  Zuckerberg  announced 
the  launch  of  Graph  Application  19  Programming  Interface  (“Graph  API”)  at  Facebook’  s 
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annual  developer  conference.  Graph  API  allows  developers  to  read  and  write  data  from  and  to 
Facebook  and  to  obtain,  track,  and  share  information.  Through  Graph  API  and  later  iterations 
of  the  “social  graph,”  Facebook  obtains  and  shares  information  about  users  through  “features” 
that  third  parties  can  implement  on  their  own  websites,  such  as  the  “Like”  button,  the  “Share” 
button,  and  the  “Log  in  with  Facebook”  option,  among  other  things.  These  “social  plug-ins” 
enable  Facebook  and  third-party  websites  to  exchange  user  information.  Facebook  obtains 
information  about  the  websites’  users  and  activities,  including  purchases,  and  the  third-party 
websites  can  also  receive  information  from  Facebook. 

143.  One  of  Facebook’s  earliest  forays  into  the  data-sharing  world  was  Beacon,  a 
program  that  launched  in  2007,  which  provided  Facebook  with  information  about  a  Facebook 
user’s  purchases  from  third  party  websites  after  the  transaction  occurred.  Facebook  then 
publicized  this  information  to  the  user’s  friends  via  News  Feed,  which  would  include  the  user’s 
name,  what  they  did  (bought  something),  what  they  bought,  and  where  they  bought  it. 

144.  TechCrunch  reported  at  the  time,  “Beacon  is  the  internal  project  name  at 
Facebook  around  an  effort  to  work  with  third  parties  and  gain  access  to  very  specific  user 
data.”  According  to  TechCrunch,  “third  parties  supply  this  data  to  Facebook  “without 
compensation;  what  they  get  in  return  is  a  link  back  in  the  News  Feed  (which  is  effectively  a 
free  ad).  Facebook,  of  course,  gets  incredibly  valuable  data  about  the  user.”  TechCrunch 
noted  that  this  data  could  be  used  to  serve  targeted  ads  back  to  users  “in  various  other  places  on 
Facebook  and  elsewhere.”  TechCrunch  also  noted  that  there  had  been  “endless  speculation 
around  the  new  advertising  network  that  Facebook  will  be  launching[,]”  but  that  “a  leaked 
Facebook  document  makes  at  least  one  part  of  the  network  clear.  Facebook  is  going  to  be 
gunning  hard  to  get  lots  and  lots  of  third  party  data  about  its  users  into  its  database.” 

145.  Defendants  subsequently  expanded  Facebook’s  access  to  and  use  of  personal 
information  through  partnership  agreements  and  referral  services  with  third  party  companies. 
For  example,  Facebook’s  agreements  with  mobile  device  manufacturers  allowed  Facebook  to 
implement  its  features  directly  on  mobile  devices,  which  enabled  Facebook  to  obtain 
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information  about  mobile  device  users,  including  non-Facebook  users,  and  to  track  users  across 
devices. 

146.  Defendants  also  pursued  their  strategy  of  monetizing  Facebook’s  platform 
through  partnerships  with  third  party  companies,  utilizing  third-party  developers  to  obtain  as 
much  user  data  as  possible,  and  by  acquiring  competitors.  Facebook’s  agreements  with  mobile 
device  manufacturers,  for  example,  allowed  Facebook  to  implement  its  features  directly  on 
mobile  devices,  which  enabled  Facebook  to  obtain  information  about  mobile  device  users, 
including  non-Facebook  users,  and  to  track  users  across  devices.  And,  Facebook  bought 
WhatsApp  in  2014  for  $19  billion,  when  it  was  the  preferred  instant  messaging  platform  in  the 
developing  world,  and  substantially  increased  Facebook’s  user  base  and  access  to  data  through 
messaging. 

3.  Defendants  Transitioned  Facebook’s  Advertising  Business  to  Mobile 
Devices  Beginning  in  2011  and  the  Company’s  Revenues  Skyrocketed 

147.  In  201 1  and  2012,  to  transition  Facebook  from  its  collapsing  desktop  advertising 
business  to  mobile  advertising,  Zuckerberg  and  the  other  Defendants  implemented  a  strategy  to 
leverage  user  data  through  though  what  they  called  “reciprocity.”  It  has  since  been  revealed 
that  “reciprocity”  meant  that  Facebook  shared  user  data  with  over  50  companies,  pursuant  to 
agreements  that  for  the  most  part  are  still  in  effect.  The  plan  involved  obtaining  additional  data 
about  Facebook  users  and  non-users  from  third  parties,  including  data  brokers,  and  leveraging 
data  that  Facebook  obtained  through  relationships  and  agreements  with  other  third  party 
companies. 

148.  In  2012,  most  of  Facebook’s  revenue  came  from  generic  banner  ads  delivered  to 
users  visiting  the  Company’s  website  on  a  desktop  computer.  By  the  fourth  quarter  of  2013, 
fifty-three  percent  of  the  Company’s  advertising  revenue  came  from  targeted  advertisements 
that  Facebook  delivered  to  smartphones,  tablets,  and  other  mobile  devices,  with  many  of  those 
ads  highly  targeted  by  gender,  age  and  other  user  demographics.  “I  think  it’s  inarguable  that 
Facebook  is  a  mobile-first  company,”  Facebook’s  chief  financial  officer  said  in  an  interview  at 
the  time. 
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1 49.  Facebook  had  total  revenue  of  $2.59  billion  in  the  quarter  that  ended  December 
31,  201 3,  up  from  $1.59  billion  in  the  same  quarter  the  previous  year.  Revenue  from 
advertising  was  $2.34  billion,  up  76  percent  from  the  previous  year.  Excluding  compensation 
costs  related  to  Facebook’s  initial  public  offering  (“IPO”)  in  2012,  the  Company’s  profits  were 
up  83  percent.  “It’s  hard  to  see  any  flaws  in  this  quarter,”  commented  one  analyst,  Ron  Josey 

of  JMP  Securities.  “They’re  seeing  demand  for  their  ad  product  go  through  the  roof.” 

A.  Facebook’s  Misleading  and  Deceptive  Practices  Respecting  User 

Privacy  Were  the  Subject  of  an  FTC  Investigation  in  2011.  and  the 

Board  Was  Forced  to  Agree  to  a  Consent  Order  to  Resolve  the  FTC 

Complaint 

1 50.  In  201 1 ,  following  an  investigation  by  the  FTC,  Facebook  was  forced  to  agree  to 
the  terms  of  a  consent  order  that  was  subsequently  entered  by  a  federal  court  (the  “Consent 
Order”),  in  order  to  resolve  the  FTC’s  complaint  against  Facebook  alleging  that  the  claims 
Facebook  made  about  its  privacy  practices  were  unfair  and  deceptive,  and  violated  federal  law. 

151 .  According  to  the  FTC  complaint,  the  Company  had  allegedly  failed  to  disclose  to 
Facebook  users  that  “a  user’s  choice  to  restrict  profile  information  to  ‘Only  Friends’  or 
‘Friends  of  Friends’  would  be  ineffective  as  to  certain  third  parties;”  that  the  company’s 
“Privacy  Wizard”  tool  for  controlling  access  to  user  information  “did  not  disclose  adequately 
that  users  no  longer  could  restrict  access  to  their  newly-designated  (publicly  available 
information)  via  their  Profile  Privacy  Settings,  Friends’  App  Settings,  or  Search  Privacy 
Settings,  or  that  their  existing  choices  to  restrict  access  to  such  information  via  these  settings 
would  be  overridden;”  and  that,  after  making  changes  to  its  privacy  policy,  Facebook  “failed  to 
disclose,  or  failed  to  disclose  adequately,  that  the  December  Privacy  Changes  overrode  existing 
user  privacy  settings  that  restricted  access  to  a  user’s  Name,  Profile  Picture,  Gender,  Friend 
List,  Pages,  or  Networks.” 

1 52.  An  early  draft  of  the  FTC  complaint  against  Facebook  reveals  that  the  FTC 
investigation  found  that  defendant  Zuckerberg  was  responsible  for  Facebook’s  violations  of  the 
FTC  Act  that  gave  rise  to  the  FTC  Consent  Order,  and  acted  together  with  other  officers  and/or 
directors  of  Facebook  who  are  also  liable  for  such  violations,  confirming  that  Zuckerberg’ s 

COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

42 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


3ase  4:18-cv-01792-HSG 


Document  124-2 


Filed  08/01/19  Page  49  of  143 


domination  and  control  of  Facebook’s  Board  was  a  substantial  contributing  factor  to  the 
violations  of  law  that  gave  rise  to  the  FTC  Consent  Order  and  that  the  other  directors  will  not 
commence  litigation  against  Zuckerberg,  either  because  it  would  expose  them  to  personal 
liability  for  similar  violations  of  law,  or  because  they  will  not  take  any  action  that  may  threaten 
their  positions  on  Facebook’s  Board  pursuant  to  which  they  have  received  and  continue  to 
receive  lucrative  compensation  and  benefits,  as  alleged  herein.  The  caption  page  of  a  draft 
complaint  by  the  FTC  that  names  Zuckerberg  as  a  defendant  is  depicted  below: 

DRAFT 

UNITED  STATES  OF  AMERICA 
FEDERAL  TRADE  COMMISSION 

COMMISSIONERS;  Jon  Lcibowite,  Chairman 

William  F~  Kovacic 
J.  Thomas  Roseh 
Edith  Ramirez 
Julie  Brill 


) 

) 

> 

) 

)  DOCKET  NO. 

) 

) 

) 

) 

> 

1 

_ _ _ ) 

COMPLAINT 

The  Federal  Trade  Commission,  having  reason  to  believe  that  Facebook,  Inc.,  a 
corporation,  and  Mark  Zuckerberg,  individually  and  as  a  founder,  officer,  and  owner  of 
Facebook,  Inc.  Htapondents”)  lave  violated  the  Federal  Trade  Commission  Act  (“FTC  Act") 
and  it  appearing  to  the  Commission  that  this  proceeding  is  in  the  public  interest,  alleges; 

1,  Reapuuderii  FoveUjuk,  Juts. (“Pueetwh"),  is  a  privately-owned,  Delaware  corporation 
with  its  principal  office  or  place  of  business  at  1601  S.  California  Avenue,  Palo  Alto, 
California,  94304,  . 

2.  Respondent  Mark  Zuckerberg  (“Zuckerberg^)  founded  Facebook  and  has  been  its  CEO 
and  the  company’s  largest  shareholder  from  approximately  2004  until  the  present,  lie 
also  is  the  company’s  President,  controls  the  appointment  of  a  majority  of  its  Board  of 
Directors  (“Board”),  and  serves  on  the  Board.  Individually,  or  in  concert  with  others,  he 
has  formulated,  directed,  participated  in,  controlled,  or  had  authority  to  control,  the 
policies,  acts,  or  practices  of  Facebook,  including  the  policies,  acts,  or  practices  alleged 
in  this  complaint,  and  has  had  knowledge  of  those  practices. 

.3 ,  The  acts  and  practices  of  Respondents  as  alleged  in  this  complaint  have  been  in  or 
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1 53 .  The  FTC’s  complaint  listed  a  number  of  instances  in  which  Facebook  allegedly 
made  promises  that  it  did  not  keep,  including: 

•  In  December  2009,  Facebook  changed  its  website  so  certain  information  that 
users  may  have  designated  as  private  -  such  as  their  Friends  List  -  was  made 
public.  Facebook  didn’t  warn  users  that  this  change  was  coming,  or  get  their 
approval  in  advance. 

•  Facebook  represented  that  third-party  apps  that  users  installed  would  have  access 
only  to  user  information  that  they  needed  to  operate.  In  fact,  the  apps  could 
access  nearly  all  of  users’  personal  data  -  which  the  apps  didn’t  need. 

•  Facebook  told  users  they  could  restrict  sharing  of  data  to  limited  audiences  -  for 
example  with  “Friends  Only.”  In  fact,  selecting  “Friends  Only”  did  not  prevent 
their  information  from  being  shared  with  third-party  applications  their  friends 
used. 

•  Facebook  had  a  “Verified  Apps”  program  and  the  Company  claimed  that  it 
certified  the  security  of  participating  apps.  It  didn’t. 

•  Facebook  promised  users  that  it  would  not  share  their  personal  information  with 
advertisers.  It  did. 

•  Facebook  claimed  that  when  users  deactivated  or  deleted  their  accounts,  their 
photos  and  videos  would  be  inaccessible.  But  Facebook  allowed  access  to  the 
content,  even  after  users  had  deactivated  or  deleted  their  accounts. 

•  Facebook  claimed  that  it  complied  with  the  U.S.-  EU  Safe  Harbor  Framework 
that  governs  data  transfer  between  the  U.S.  and  the  European  Union.  It  didn’t. 

1 54.  On  November  29,  2011,  the  FTC  announced  that  Facebook  and  the  agency  had 
reached  an  agreement  on  the  terms  of  the  Consent  Order  relating  to  the  FTC’s  charges  that  the 
company  had  “deceived  consumers  by  telling  them  they  could  keep  their  information  on 
Facebook  private,  and  then  repeatedly  allowing  it  to  be  shared  and  made  public.” 
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155.  The  FTC  Consent  Order  required  that  Facebook  must  not  “misrepresent  in  any 
manner,  expressly  or  by  implication,  the  extent  to  which  it  maintains  the  privacy  or  security  of 
covered  information,”  including  “the  extent  to  which  [Facebook]  makes  or  has  made  covered 
information  accessible  to  third  parties;”  that  prior  to  sharing  of  a  user’s  nonpublic  information, 
the  company  will  “obtain  the  user’s  affirmative  express  consent;”  and  the  company  would 
“establish  and  implement,  and  thereafter  maintain,  a  comprehensive  privacy  program  that  is 
reasonably  designed  to  (1)  address  privacy  risks  related  to  the  development  and  management  of 
new  and  existing  products  and  services  for  consumers,  and  (2)  protect  the  privacy  and 
confidentiality  of  covered  information,”  among  other  stipulations. 

156.  The  FTC  Consent  Order  barred  Facebook  from  making  any  further  deceptive 
privacy  claims,  required  Facebook  to  obtain  consumers’  approval  before  it  changed  the  way  it 
shared  their  data,  and  required  Facebook  to  obtain  periodic  assessments  of  its  privacy  practices 
by  independent,  third-party  auditors  for  20  years  following  its  entry. 

1 57.  Facebook  has  specific  obligations  under  the  FTC  Consent  Order  and  the  Board  is 
duty-bound  to  oversee  Facebook’ s  compliance  with  its  terms.  Specifically,  under  the  Consent 
Order,  Facebook  is: 

•  barred  from  making  misrepresentations  about  the  privacy  or  security  of 

consumers’  personal  information;  ' 

•  required  to  obtain  consumers’  affirmative  express  consent  before  enacting 
changes  that  override  their  privacy  preferences; 

•  required  to  prevent  anyone  from  accessing  a  user’s  material  more  than  30  days 
after  the  user  has  deleted  his  or  her  account; 

•  required  to  establish  and  maintain  a  comprehensive  privacy  program  designed  to 
address  privacy  risks  associated  with  the  development  and  management  of  new 
and  existing  products  and  services,  and  to  protect  the  privacy  and  confidentiality 
of  consumers’  information;  and 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

45 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


;ase  4:18-cv-01792-HSG 


Document  124-2  Filed  08/01/19  Page  52  of  143 


•  required,  every  two  years  for  the  next  20  years  after  entry  of  the  Consent  Decree, 
to  obtain  independent,  third-party  audits  certifying  that  it  has  a  privacy  program 
in  place  that  meets  or  exceeds  the  requirements  of  the  FTC  order,  and  to  ensure 
that  the  privacy  of  consumers’  information  is  protected. 

158.  As  FTC  Chairman  Jon  Leibowitz  stated  in  the  FTC’s  press  release  announcing 
the  settlement  and  terms  of  the  Consent  Order  on  November  29, 2011,  “Facebook  is  obligated 
to  keep  the  promises  about  privacy  that  it  makes  to  its  hundreds  of  millions  of  users. . . 
Facebook’s  innovation  does  not  have  to  come  at  the  expense  of  consumer  privacy. . .” 
Defendants  failed  to  do  so,  and  permitted  Facebook  to  violate  federal  law,  the  laws  of  various 
U.S.  states,  and  the  laws  of  other  countries,  as  set  forth  below. 

1 59.  The  Board  was  well  aware  of  the  FTC  Consent  Order  and  the  obligations  placed 
on  Facebook,  as  each  director  personally  received  a  copy  of  the  Consent  Order  on  September 
12, 2012,  according  to  the  Facebook  Compliance  Report  that  was  submitted  to  the  FTC  by 
Facebook’s  in-house  attorneys  on  November  13,  2012,  and  the  directors  who  joined  the  Board 
after  that  date  also  received  a  copy  of  the  Consent  Order  within  thirty  (30)  days  after  their 
appointment  as  directors.  Moreover,  each  of  the  directors  is  specifically  obligated  to  oversee 

the  Company’s  compliance  with  its  terms. 

B.  The  Cambridge  Analytica  Incident  Reveals  Rampant  Privacy 

Violations  at  Facebook  and  That  Defendants  Failed  to  Comply  With 

the  FTC  Consent  Order 

160.  On  March  16, 2018,  a  Facebook  Newsroom  post  reported  that  an  app  developer 
named  Aleksandr  Kogan  had  “violated  Facebook’s  platform  policy”  by  “passing  information 
on”  about  its  users  to  third  parties,  including  a  company  called  Cambridge  Analytica. 
Facebook  said  that  although  Kogan  had  “gained  access  to  this  information  in  a  legitimate  way 
and  through  the  proper  channels,”  he  violated  Facebook’s  policies  when  he  shared  this 
information  with  Cambridge  Analytica  without  Facebook  users’  consent.  As  a  result,  Kogan’s 
app  was  removed  from  Facebook  and  “all  parties”  who  received  the  data  from  Kogan  were 
required  to  certify  that  it  had  been  destroyed  in  2015  or  2016. 
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161.  According  to  Facebook,  “Facebook  obtained  written  certifications  from  Dr. 
Kogan,  GSR,  and  other  third  parties  . . .  declaring  that  all  such  data  they  had  obtained 
(including  derivative  data)  was  accounted  for  and  destroyed.”  Facebook  stated  that  in  March, 
2018  the  Company  “received  information  from  the  media  suggesting  that  the  certifications  we 
[Facebook]  received  may  not  have  been  accurate. . .  As  part  of  our  investigation,  we  have  hired 
a  forensic  auditor  to  understand  what  information  Cambridge  Analytica  had  and  whether  it  has 
been  destroyed.” 

1 62.  Although  Facebook  had  years  to  confirm  the  authenticity  and  accuracy  of  the 
certifications,  it  was  not  until  the  Observer  asked  Facebook  to  comment  just  a  few  days  prior  to 
breaking  the  news  about  Cambridge  Analytica  that  Facebook  announced  that  it  was  (finally) 
suspending  Cambridge  Analytica  and  Kogan  from  the  platform  pending  further  information 
over  misuse  of  data.  Facebook  also  said  it  was  suspending  Christopher  Wylie,  a  Canadian  data 
analytics  expert  who  worked  with  Cambridge  Analytica  and  Kogan  to  create  the  app,  from 
accessing  the  platform  while  Facebook  carried  out  its  “internal  investigation”  into  the  matter. 

163.  Wylie  provided  evidence  to  The  Observer,  the  U.K.’s  National  Crime  Agency’s 
cybercrime  unit,  and  the  Information  Commissioner’s  Office,  of  the  information  that  Kogan 
and  Cambridge  Analytica  had  obtained  about  50  million  Facebook  users.  Wylie  also  said  that 
the  Company  was  aware  of  the  volume  of  data  that  was  obtained  by  Kogan’s  app.  “Their 
security  protocols  were  triggered  because  Kogan’s  apps  were  pulling  this  enormous  amount  of 
data,  but  apparently  Kogan  told  them  it  was  for  academic  uses,”  Wylie  said.  “So  they  were 
like:  ‘Fine.’” 

164.  The  evidence  Wylie  supplied  to  U.K.  and  U.S.  authorities  includes  a  letter  from 
Facebook  lawyers  sent  to  him  in  August  2016,  asking  him  to  destroy  any  data  he  held  that  had 
been  collected  by  GSR,  the  company  set  up  by  Kogan  to  “harvest”  the  profiles.  “Because  this 
data  was  obtained  and  used  without  permission,  and  because  GSR  was  not  authorized  to  share 
or  sell  it  to  you,  it  cannot  be  used  legitimately  in  the  future  and  must  be  deleted  immediately,” 
the  letter  said.  According  to  Wylie,  Facebook  did  not  pursue  a  response  when  the  letter 
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initially  went  unanswered  for  weeks  because  Wylie  was  travelling,  nor  did  it  follow  up  with 
forensic  checks  on  his  computers  or  storage.  “That  to  me  was  the  most  astonishing  thing.  They 
waited  two  years  and  did  absolutely  nothing  to  check  that  the  data  was  deleted.  All  they  asked 
me  to  do  was  tick  a  box  on  a  form  and  post  it  back.” 

165.  On  March  27,  2018,  Wylie  testified  before  a  U.K.  Parliamentary  Committee  that 
the  data  that  Kogan’s  app  had  obtained  via  Facebook  formed  the  “foundational  dataset”  for 
Cambridge  Analytica  and  its  targeting  models.  “This  is  what  built  the  company,”  Wylie  stated. 
“This  was  the  foundational  dataset  that  then  was  modeled  to  create  the  algorithms.” 

1 66.  When  asked  by  the  Parliamentary  Committee  how  the  data  was  used  by 
Cambridge  Analytica,  Wylie  said  the  company’s  approach  was  to  target  different  people  for 
advertising  based  on  their  “dispositional  attributes  and  personality  traits”  —  traits  it  sought  to 
predict  via  patterns  in  the  data.  Wylie  explained: 

[I]f  you  are  able  to  create  profiling  algorithms  that  can  predict  certain 
traits  —  ...  and  []  if  you  can  create  a  psychological  profile  of  a  type  of 
person  who  is  more  prone  to  adopting  certain  forms  of  ideas,  conspiracies 
for  example,  you  can  identify  what  that  person  looks  like  in  data  terms. 

You  can  then  go  out  and  predict  how  likely  somebody  is  going  to  be  to 
adopt  more  conspiratorial  messaging.  And  then  advertise  or  target  them 
with  blogs  or  websites  . . . 

...  so  that  advantage  of  using  profiling  is  you  can  find  the  specific  group 
of  people  who  are  more  prone  to  adopting  that  idea  as  your  early 
adopters.... 

167.  “That  was  the  basis  of  a  lot  of  our  research  [at  Cambridge  Analytica  and  sister 
company  SCL],”  Wylie  added.  “How  far  can  we  go  with  certain  types  of  people.  And  who  is  it 
that  we  would  need  to  target  with  what  types  of  messaging.”  Wylie  told  the  Committee  that 
Kogan’s  company  was  set  up  exclusively  for  the  purposes  of  obtaining  data  for  Cambridge 
Analytica. 

168.  Wylie’s  testimony  also  suggested  Facebook  found  out  about  the  GSL  data 
harvesting  project  as  early  as  July  2014  — around  the  time  Kogan  had  told  him  that  he  had 
spoken  to  Facebook  engineers  after  his  app’s  data  collection  rate  had  been  throttled  by  the 
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platform.  “He  told  me  that  he  had  a  conversation  with  some  engineers  at  Facebook,”  said 
Wylie.  “So  Facebook  would  have  known  from  that  moment  about  the  project  because  he  had  a 
conversation  with  Facebook’s  engineers  —  or  at  least  that’s  what  he  told  me. . .  Facebook’s 
account  of  it  is  that  they  had  no  idea  until  the  Guardian  first  reported  it  at  the  end  of  201 5  — 
and  then  they  decided  to  send  out  letters.  They  sent  letters  to  me  in  August  2016  asking  do  you 
know  where  this  data  might  be,  or  was  it  deleted?”  Wylie  noted,  “[ijt’s  interesting  that. . .  the 
date  of  the  letter  is  the  same  month  that  Cambridge  Analytica  officially  joined  the  Trump 
campaign.  So  I’m  not  sure  if  Facebook  was  genuinely  concerned  about  the  data  or  just  the 
optics  of  y’know  now  this  firm  is  not  just  some  random  firm  in  Britain,  it’s  now  working  for  a 
presidential  campaign.” 

1 69.  When  asked  whether  Facebook  made  any  efforts  to  retrieve  or  delete  data,  Wylie 
responded,  “No  they  didn’t.”  It  was  not  until  Facebook’s  image  was  threatened  in  2018,  “after 
I  went  public  and  then  they  made  me  suspect  number  one”  that  Wylie  said  he  had  heard 
anything  from  the  Company.  Wylie  said  that  he  suspected  that  when  Facebook  looked  at  what 
happened  in  2016,  “they  went  if  we  make  a  big  deal  of  this  this  might  be  optically  not  the  best 
thing  to  make  a  big  fuss  about. ...  So  I  don’t  think  they  pushed  it  in  part  because  if  you  want  to 
really  investigate  a  large  data  breach  that’s  going  to  get  out  and  that  might  cause  problems.  So 
my  impression  was  they  wanted  to  push  it  under  the  rug.”  He  added,  “[a]ll  kinds  of  people 
[had]  access  to  the  data.  It  was  everywhere.” 

170.  These  revelations,  coupled  with  the  growing  concern  about  Russian  involvement 
in  the  2016  presidential  campaign  -  and  Facebook’s  inattention  to  Russian  fake-news  feeds  - 
drew  unwanted  attention  to  Facebook’s  business  model:  monetizing  personal  user  data. 

171.  Instead  of  accepting  the  uncomfortable  glare  of  the  spotlight  and  accepting 
responsibility  for  any  mistakes  it  might  have  made,  Defendants  went  into  “PR  crisis  mode,” 
quickly  seizing  upon  Kogan  and  Wylie  as  convenient  scapegoats.  “This  was  a  scam  —  and  a 
fraud,”  Paul  Grewal  (“Grewal”),  Facebook’s  Vice  President  and  Deputy  General  Counsel,  said 
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in  an  initial  statement  to  the  New  York  Times.  He  added  that  the  company  was  suspending 
Cambridge  Analytica,  Wylie  and  Kogan,  a  Russian  American  academic  from  Facebook. 

172.  In  response  to  the  reports  about  the  misappropriation  of  user  data  by  Cambridge 
Analytica,  Defendants  made  and  caused  to  be  made  on  Facebook’ s  behalf  various  other  false 
and  misleading  statements,  including  as  follows. 

173.  Paul  Grewal,  Vice  President  &  Deputy  General  Counsel  of  Facebook,  stated,  in  a 
Facebook  News  release  on  March  16, 2018  that  “Dr.  Aleksandr  Kogan  lied  to  us.” 

1 74.  On  March  1 6, 2018,  Mr.  Grewal  intentionally  and  knowingly  misstated  the 
purpose  of  Dr.  Kogan’s  app  when  he  stated  in  the  Facebook  News  release:  “In  2015,  we 
learned  that  a  psychology  professor  at  the  University  of  Cambridge  named  Dr.  Aleksandr 
Kogan  lied  to  us  and  violated  our  Platform  Policies  . . .  His  app,  ‘thisisyourdigitallife,’  offered  a 
personality  prediction,  and  billed  itself  on  Facebook  as  ‘a  research  app  used  by  psychologists.’” 

175.  Alex  Stamos,  Facebook ’s  Chief  Security  Officer  at  the  time,  tweeted  on  March 
17, 2018:  “The  researcher  in  question,  Aleksandr  Kogan,  enticed  several  hundred  thousand 
individuals  to  use  Facebook  to  login  to  his  personality  quiz  in  2014.  He  lied  to  those  users  and 
he  lied  to  Facebook  about  what  he  was  using  that  data  for.” 

176.  On  March  21,  2018,  Zuckerberg  told  CNN:  “You  can’t  share  data  in  a  way  that 
people  don’t  know  or  don’t  consent  to.  We  immediately  banned  Kogan’s  app.” 

177.  Zuckerberg  wrote,  on  his  own  Facebook  page,  on  March  21, 2018:  “In  2015,  we 
learned  from  journalists  at  The  Guardian  that  Kogan  had  shared  data  from  his  app  with 
Cambridge  Analytica.  It  is  against  our  policies  for  developers  to  share  data  without  people’s 
consent,  so  we  immediately  banned  Kogan’s  app  from  our  platform.” 

178.  Zuckerberg  stated,  in  an  interview  with  Recode,  published  on  March  22, 2018: 
“Then  there’s  going  backwards,  which  is  before  2014,  what  are  all  the  apps  that  got  access  to 
more  data  than  people  would  be  comfortable  with?  And  which  of  them  were  good  actors,  like 
legitimate  companies,  good  intent  developers,  and  which  one  of  them  were  scams,  right?  Like, 
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what  Aleksandr  Kogan  was  doing,  basically  using  the  platform  to  gather  a  bunch  of 
information,  sell  it  or  share  it  in  some  sketchy  way.” 

C.  Defendants  Misrepresented  the  Impact  That  the  Cambridge 

Analvtica  Scandal  and  Subsequent  Revelations  Would  Have  on 

Facebook’s  Financial  Performance 

179.  Despite  the  public  admissions  that  Facebook’s  privacy  and  enforcement  practices 
were  not  what  they  had  been  portrayed  to  be,  Defendants  assured  investors  that  the  disclosures 
had  only  minor  impacts  on  user  engagement  and  would  not  have  a  material  impact  on  the 
Company’s  financial  performance.  For  example: 

•  When  Zuckerberg  testified  before  Congress  on  April  10-1 1 , 201 8,  he  represented 
that  Facebook  had  seen  no  dramatic  declines  in  the  number  of  Facebook  users 
and  no  decrease  in  user  interaction  on  Facebook  whatsoever. 

•  When  Facebook  shareholders  formally  proposed  that  the  Company  explore 
implementing  a  “risk  oversight  committee”  and  issue  related  reports  due  to 
concerns  that  “[t]he  Cambridge  Analytica  scandal  and  the  misuse  of  data  to 

I 

influence  elections  around  the  world,”  20  defendants  opposed  the  requests, 
assuring  investors  that  Facebook’s  existing  risk  oversight  was  adequate.  The 
shareholder  proposals  were  not  adopted. 

•  When  Facebook  reported  its  1Q18  results  on  April  25,  2018,  defendants  said  that 
user  activity  had  increased,  advertising  effects  were  de  minimis,  and  increased 
spending  on  security  in  the  wake  if  the  Cambridge  Analytica  scandal  was  already 
reflected  in  the  quarterly  results. 

1 80.  On  May  3 1 , 201 8,  Zuckerberg  told  investors  relatively  few  users  were  taking 

£ 

advantage  of  new  privacy  regulations  in  Europe  requiring  users  to  opt  in  to  data  sharing  (rather 
than  the  historic  opt-out  procedures),  assuring  investors  that  the  Company’s  business  model 
was  not  at  risk  because  the  “vast  majority”  of  users  had  opted  in  to  Facebook’s  use  of  their  data 
for  advertising  and  other  purposes. 
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181.  Buoyed  by  a  favorable  first  quarter  20 1 8  (“1 Q 1 8”)  earnings  report  and  the 
purported  lack  of  financial  impact  resulting  from  the  Cambridge  Analytica  scandal,  Facebook’s 
stock  price  immediately  climbed  by  more  than  9%  following  the  1Q18  earnings  report. 
Facebook’s  stock  price  continued  to  climb  thereafter,  as  defendants  continued  to  make  positive 
statements  about  their  response  to  the  recent  controversy  and  the  health  of  Facebook’s  business 
in  its  wake.  By  July,  Facebook’s  stock  price  was  trading  well  above  $200  per  share. 

1 82.  On  July  25,  2018,  the  Company  reported  its  second  quarter  2018  (“2Q1 8”) 
earnings,  stunning  investors  when  Facebook  finally  revealed  that  its  privacy  misconduct  had  in 
fact  hit  the  Company’s  bottom  line  and  seriously  impacted  its  business.  Among  other  things, 
defendants  reported  a  significant  decline  in  users  in  Europe,  zero  user  growth  in  the  United 
States,  decelerating  worldwide  growth  of  active  users  (i.e.,  those  most  responsible  for 
generating  data  used  in  targeted  advertising),  lower  than  expected  revenues  and  earnings, 
ballooning  expenses  affecting  profitability,  and  reduced  guidance  going  forward.  All  of  this 
was  a  direct  result  of  the  disclosures  concerning  Facebook’s  true  privacy  practices,  including 
its  misrepresentations  about  its  efforts  to  prevent  and  address  events  like  the  Cambridge 
Analytica  data  breach  and  the  impact  of  GDPR.  Indeed,  Zuckerberg  opened  the  July  25,  2018 
investor  conference  call  by  discussing  “all  the  investments  we’ve  made  over  the  last  6  months 
to  improve  safety,  security  and  privacy  across  our  services,”  which  had  “significantly 
impacted]  our  profitability.” 

1 83.  Market  reaction  to  the  Company’s  2Q1 8  earnings  report  and  conference  call  was 
swift  and  severe,  causing  the  price  of  Facebook’s  common  stock  to  drop  by  nearly  19%  on  July 
26, 2018,  for  a  staggering  single-day  loss  of  approximately  $100  billion  in  market 
capitalization  that  was  the  largest  such  one-day  drop  in  U.S.  history.  By  July  30,  2018,  the 
price  of  Facebook  stock  had  fallen  by  21%,  shedding  approximately  $1 12  billion  in  market 
capitalization. 

1 84.  >  By  December  of  2018,  Facebook’s  stock  price  was  languishing  at  around  $  1 23, 
well  below  its  all-time  high  just  a  few  months  earlier  of  $21 8  in  July  of  201 8. 
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185.  On  January  30,  2019,  Facebook  announced  its  financial  results  for  the  fourth 
quarter  of  2018,  and  on  January  31,  2019,  Facebook  filed  its  Annual  Report  on  Form  10-K  for 
2018.  Facebook  reported  revenue  growth  of  26  percent  year  over  year,  the  Company’s  lowest 
since  its  2012  IPO. 

186.  In  February  22,  2019,  a  BuzzFeed  News  article  entitled  “Former  Facebook 
Employees  Say  The  Company’s  Recent  Prioritization  Of  Privacy  Is  All  About  Optics”  reported 
as  follows: 

Facebook  has  long  portrayed  itself  as  an  advocate  for  user  rights.  But  former 
employees  and  critics  say  the  company’s  true  ethos  has  often  been  in  opposition  to 
this.  Facebook’s  communications  around  privacy  have  historically  been 
opportunistic  and  protectionist,  deployed  to  cover  up  for  the  last  transgression  from 
its  “move  fast  and  break  things”  ideology  —  from  the  2007  Beacon  program,  which 
allowed  companies  to  track  purchases  by  Facebook  users  without  their  consent,  to 
the  2010  loophole  that  allowed  advertisers  to  access  people’s  personal  Facebook 
information  without  permission. 


As  Facebook  dealt  with  fallout  from  Cambridge  Analytica,  compliance  with 
Europe’s  new  General  Data  Protection  Regulation  (GDPR),  and  renewed  attention 
on  how  it  tracks  all  internet  users  following  Zuckerberg’s  ten  hours  of 
congressional  testimony  in  April,  the  company’s  ask-forgiveness-not-permission 
playbook  was  in  plain  view.  It  took  out  full-page  newspaper  apologies,  placed  its 
chief  executive  on  podcasts  and  televised  interviews,  and  sent  Sandberg  to  meet 
with  state  attorneys  general  and  lawmakers  behind  closed  doors.  “My  worry  is  that 
Facebook  is  doing  anything  it  can  to  gamer  goodwill  and  diffuse  concern,”  said 
Ashkan  Soltani,  the  FTC’s  chief  technologist  from  October  2014  to  November 
2015.  “I’m  not  sure  of  the  sincerity  of  those  actions  since,  historically,  the  company 
uses  privacy  selectively  and  strategically.” 

1 87.  Five  former  employees  who  spoke  with  BuzzFeed  News  said  they  are  skeptical 
of  that  goodwill  effort,  with  three  noting  that  the  external  messaging  and  marketing  around 
privacy  has  only  become  a  focus  for  executives  during  the  last  12  months.  “They  have  a  long- 
running  strategy  of  using  communications  to  disagree  and  push  this  counter-narrative  against 
any  criticism,”  one  Facebook  employee  said.  “They’re  playing  the  same  game  they’ve  always 
played,  but  the  challenge  for  them  is  that  the  world  has  changed  and  privacy  concerns  are 
increasing  dramatically.” 
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1 88.  Two  people  who  used  to  work  at  Facebook  said  that  it’s  hard  to  take  the 
company’s  apologies  and  commitments  to  privacy  seriously  after  witnessing  its  attempt  to  get 
ahead  of  outlets  preparing  to  publish  stories  about  Cambridge  Analytica.  Last  March,  the  New 
York  Times,  the  Guardian,  and  the  Observer  were  readying  stories  about  a  former  employee  at 
the  political  consulting  firm  who  had  evidence  that  Cambridge  Analytica  had  illicitly  obtained 
data  on  millions  of  Facebook  users  and  deployed  that  information  for  American  political 
campaigns.  The  outlets,  according  to  multiple  people  familiar  with  the  situation,  had  been  in 
communication  with  Facebook  about  their  stories  for  at  least  a  week,  and  the  company’s  public 
relations  team  was  well-aware  that  the  pieces  would  be  published  on  the  weekend.  In  response, 
Facebook’ s  communications  team  decided  to  get  ahead  of  the  stories,  publishing  a  blog  post 
from  the  company’s  deputy  general  counsel  the  preceding  Friday  about  suspending  accounts 
associated  with  Cambridge  Analytica.  “We  were  essentially  scooping  the  news,”  one  source 
said,  explaining  that  Facebook  was  trying  to  soften  the  blow  of  any  future  story  on  the  matter. 

1 89.  Another  former  employee  noted  that  Facebook’s  executives  historically  only  took 
privacy  seriously  if  problems  affected  the  key  metrics  of  daily  active  users,  which  totaled  1.52 
billion  accounts  in  December,  or  monthly  active  users,  which  totaled  2.32  billion  accounts. 

Both  figures  increased  by  about  9%  year-over-year  in  December.  “If  it  came  down  to  user 
privacy  or  MAU  growth,  Facebook  always  chose  the  latter,”  the  person  said.  That  source 
pointed  to  internal  Facebook  emails  obtained  and  released  by  a  UK  parliamentary  inquiry  that 
showed,  among  other  things,  the  company’s  then-deputy  chief  privacy  officer  Yul  Kwon 
discussing  how  to  allow  Facebook’s  Android  app  to  read  a  phone’s  call  logs  without  triggering 
a  permission  pop-up. 

190.  Ironically,  Facebook’s  leaders  were  worried  about  the  public  relations  scenario 
that  could  have  occurred  if  Android’s  permissions  did  appear,  as  they  were  intended,  to  ask 
users  to  consent  to  the  app  reading  their  call  logs.  Instead  of  asking  for  less  access,  however, 
they  sought  a  workaround  so  that  they  could  still  suck  up  the  data  without  making  people  aware 
that  they  were  doing  so.  “This  is  a  pretty  high  risk  thing  to  do  from  a  PR  perspective  but  it 
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appears  that  the  growth  team  will  charge  ahead  and  do  it,”  one  Facebook  employee,  Michael 
LeBeau,  wrote  in  early  2015.  “We  think  the  risk  of  PR  fallout  here  is  high.” 

191.  The  fallout,  however,  came  more  than  three  years  after  those  emails,  after  U.K. 
parliamentarians  obtained  them  and  used  them  to  bolster  their  case  that  Facebook  operated  as  a 
“digital  gangster”  with  little  regard  for  law  or  scrutiny  in  a  report  earlier  this  month.  “It  is 
evident  that  Facebook  intentionally  and  knowingly  violated  both  data  privacy  and  anti¬ 
competition  laws,”  the  House  of  Commons  Digital,  Culture,  Media,  and  Sport  (DCMS) 
Committee  wrote  in  what  is  perhaps  the  strongest  rebuke  of  the  company  by  a  governing  body 
to  date. 

1 92.  Many  of  the  former  Facebook  insiders  who  spoke  with  BuzzFeed  News  struggled 
to  understand  why  there  have  been  few  management  changes  after  that  past  year.  “Certain 
leaders  have  been  making  bad  calls,”  one  said,  leaving  the  company  in  “crisis  after  crisis.”  Yet 
aside  from  an  executive  shuffle  where  leaders  were  reorganized  into  different  positions  in  May, 
few  people,  besides  policy  and  communications  head  Elliot  Schrage,  have  been  shown  the 
door.  (And  even  Schrage  still  technically  remains  at  the  company  in  a  special  projects  advisory 
role.)  “There’s  an  abdication  of  responsibility  by  the  two  at  the  top  that  runs  deep  —  all  the 
way  down  to  junior  leadership  looking  the  other  way,”  another  former  employee  said. 

193.  The  UK’s  DCMS  committee  agreed.  “The  management  structure  of  Facebook  is 
opaque  to  those  outside  the  business  and  this  seemed  to  be  designed  to  conceal  knowledge  of 
and  responsibility  for  specific  decisions,”  it  wrote  in  December. 

194.  In  April  of  2019,  the  Washington  DC  attorney  general’s  complaint  against 
Facebook  was  made  public,  revealing  that  a  DC-based  Facebook  employee  had  raised  issues 
about  the  political  research  firm  in  September  201 5  —  months  before  The  Guardian’s  first 
report  on  it,  in  December  2015.  Although  the  exact  nature  of  the  employee’s  warning  is 
unknown,  as  the  complaint  is  redacted,  the  revelation  is  significant  because  Defendants  had 
previously  represented  that  Facebook  was  not  aware  of  the  issues  surrounding  Cambridge 
Analytica  prior  to  the  initial  report  in  December  2015. 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

55 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


ase  4:18-cv-01792-HSG  Document  124-2  Filed  08/01/19  Page  62  of  143 


195.  In  an  earlier  statement  to  The  Guardian,  Facebook  denied  that  it  had  “misled 
anyone  about  this  timeline.”  Instead,  the  Company  said,  the  issues  that  were  raised  by  an 
employee  back  in  September  2015  were  a  “different  incident”  to  the  issues  that  were 
subsequently  reported.  “In  September  2015  employees  heard  speculation  that  Cambridge 
Analytica  was  scraping  data,  something  that  is  unfortunately  common  for  any  internet  service. 
In  December  2015,  we  first  learned  through  media  reports  that  [researcher  Aleksandr]  Kogan 
sold  data  to  Cambridge  Analytica,  and  we  took  action.  Those  were  two  different  things,”  the 
spokesperson  said.  The  spokesperson  added:  “Facebook  was  not  aware  of  the  transfer  of  data 
from  Kogan/GSR  to  Cambridge  Analytica  until  December  2015,  as  we  have  testified  under 
oath.” 

196.  Damian  Collins,  a  British  MP  and  outspoken  critic  of  Facebook,  tweeted:  “This 
important  new  information  could  suggest  that  Facebook  has  consistently  mislead  the 
[Parliamentary  Digital,  Culture,  Media  and  Sport  select  committee]  about  what  it  knew  and 
when  about  Cambridge  Analytica.” 

197.  On  April  24, 2019,  Facebook  announced  its  earnings  results  for  the  first  quarter 
of  2019  —  and  announced  that  it  was  preparing  for  a  settlement  with  the  FTC  in  the  range  of 
$3-5  billion,  which  would  be  the  largest  ever  fine  by  the  FTC.  “In  the  first  quarter  of  2019,  we 
recorded  an  accrual  of  $3  billion  in  connection  with  the  ongoing  inquiry  of  the  FTC,”  a 
Facebook  spokesperson  said  in  a  statement.  “This  matter  remains  unresolved,  and  we  estimate 
that  the  associated  range  of  loss  is  between  $3  billion  and  $5  billion.”  Without  the  accrual, 
Facebook’s  earnings  per  share  would  have  been  $1 .89  —  significantly  higher  than  the  actual 
amount  of  $0.85. 

198.  In  response  to  the  results,  one  securities  analyst  stated  that  the  expected  FTC  fine 
“hurts  now  and  provides  headline  risk”  but  the  extent  of  such  risk  is  unknown,  as  is  the 
question  of  “whether  or  not  this  is  a  recurring  story.”  The  analyst  noted  “Facebook’s  massive 
spending  on  privacy  and  security  of  late”  and  concluded  hopefully  that  this  “makes  the  odds 
lower  that  it  will  be.” 

D.  Defendants  Falsely  and  Misleadingly  Represented  That  Facebook’s 
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Policies  and  Practices  Respecting  User  Privacy  and  Data  Security 

Complied  With  Applicable  Laws  and  Regulations-  Including  the  FTC 

Consent  Order 

1 99.  As  a  result  of  Facebook’s  failure  to  respond  to  the  Cambridge  Analytica  data 
breach  in  a  manner  consistent  with  its  public  statements,  a  massive  amount  of  compromised 
Facebook  data  -  later  estimates  would  reveal  that  more  than  87  million  users  were  affected  - 
remained  in  the  hands  of  malicious  actors.  Moreover,  as  defendants  knew  at  the  time  but  has 
only  recently  been  revealed  to  the  public,  Facebook’s  privacy  failures  had  permitted  thousands 
of  other  app  developers  and  other  third  parties  to  access  user  data  without  their  knowledge  or 
consent,  presenting  similar  risks  violating  user  privacy  rights. 

200.  By  concealing  the  truth  from  users  and  investors,  defendants  misled  the  market 
and  concealed  material  risks  regarding  the  most  critical  aspect  of  Facebook’s  business  -  its 
reputation  as  a  trustworthy  platform  where  users  could  share  and  control  their  private 
information.  Defendants  also  concealed  the  true  extent  of  the  risks  facing  Facebook  in 
connection  with  privacy  issues,  including  the  risk  of  slowing  growth  resulting  from  user’s 
lessening  their  activity  or  restricting  the  data  that  could  be  shared  as  its  platform.  These  risks 
also  included  that  the  Company  would  have  to  materially  increase  spending  on  privacy 
measures  required  to  provide  the  level  of  protection  described  in  Facebook’s  policies  and  their 
public  statements  in  response  to  the  Cambridge  Analytica  scandal.  Defendants  further  knew  or 
recklessly  disregarded  that  the  Company  was  at  significant  risk  and  could  become  subject  of 
increased  government  oversight  and  potentially  costly  fines  and  regulation. 

201 .  On  March  20,  201 8,  the  Guardian  reported  an  interview  with  a  former  Facebook 
employee,  Sandy  Parakilas  (“Parakilas”),  who  was  a  platforms  operations  manager  at  Facebook 
between  201 1  and  2012.  Parakilas  said  that  he  had  warned  senior  executives  at  Facebook 
about  his  concerns  that  developers  were  regularly  violating  Facebook’s  platform  policies  on 
multiple  occasions,  but  that  they  had  essentially  ignored  his  concerns. 

202.  For  example,  Parakilas  reported  that  a  developer  was  using  Facebook  data  to 
automatically  generate  profiles  of  children  without  their  (or  their  parents’)  consent,  and  that 

another  was  seeking  to  gain  access  to  a  user’s  private  Facebook  messages  and  photos.  In  an 
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op-ed  piece,  Parakilas  wrote  about  the  response  of  Facebook  management  (or  lack  thereof)  to 
these  reports: 

At  a  company  that  was  deeply  concerned  about  protecting  its  users,  this  situation 
would  have  been  met  with  a  robust  effort  to  cut  off  developers  who  were  making 
questionable  use  of  data.  But  when  I  was  at  Facebook,  the  typical  reaction  I  recall 
looked  like  this:  try  to  put  any  negative  press  coverage  to  bed  as  quickly  as  possible, 
with  no  sincere  efforts  to  put  safeguards  in  place  or  to  identify  and  stop  abusive 
developers.  When  I  proposed  a  deeper  audit  of  developers’  use  of  Facebook’s  data, 
one  executive  asked  me,  “Do  you  really  want  to  see  what  you’ll  find?” 

The  message  was  clear:  The  company  just  wanted  negative  stories  to  stop.  It  didn’t 
really  care  how  the  data  was  used. 

203.  According  to  Parakilas,  Facebook  did  not  conduct  regular  audits;  although  his 
primary  responsibilities  were  over  policy  and  compliance  for  Facebook  apps  and  data 
protection,  Parakilas  said  that  “during  my  16  months  in  that  role  at  Facebook,  I  do  not 
remember  a  single  physical  audit  of  a  developer’s  storage.” 

204.  Parakilas  also  said  that  when  he  told  his  superiors  that  “more  audits  of  developers 
and  a  more  aggressive  enforcement  regime”  were  needed,  they  did  not  directly  respond, 
because  “[essentially,  they  did  not  want  to  do  that.”  According  to  Parakilas,  “the  company 
felt  that  it  would  be  in  a  worse  legal  position  if  it  investigated  and  understood  the  extent  of 
abuse,  and  it  did  not.” 

205.  In  his  testimony  to  the  DCMS  Committee,  Parakilas  declined  to  identify  the 
Facebook  executives  he  warned  publicly  by  name  when  asked.  The  DCMS  Committee  Chair 

I 

commented,  “it  sounds  like  they  turned  a  blind  eye  because  they  did  not  want  to  find  out  that 
truth.”  Parakilas  agreed,  stating,  “That  was  my  impression,  yes.” 

206.  On  March  20,  2018,  former  FTC  Commissioner  Terrell  McSweeny  issued  the 
following  statement  regarding  recent  news  reports  of  allegedly  unauthorized  use  of  Facebook 
user  information  by  a  data  analytics  firm:  “The  FTC  takes  the  allegations  that  the  data  of 
millions  of  people  were  used  without  proper  authorization  very  seriously.  The  allegations  also 
highlight  the  limited  rights  Americans  have  to  their  data.  Consumers  need  stronger  protections 
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for  the  digital  age  such  as  comprehensive  data  security  and  privacy  laws,  transparency  and 
accountability  for  data  brokers,  and  rights  to  and  control  over  their  data.” 

207.  A  Facebook  representative  also  said  at  that  time  that  the  Company  expected  to 
receive  questions  from  the  FTC  related  to  potential  violations  of  the  201 1  Consent  Order.  “We 
remain  strongly  committed  to  protecting  people’s  information,”  Facebook’s  deputy  chief 
privacy  officer,  Rob  Sherman,  said  in  a  statement.  “We  appreciate  the  opportunity  to  answer 
questions  the  FTC  may  have.” 

208.  Just  a  few  days  later,  the  FTC  announced  it  was  investigating  Facebook  for 
violations  of  the  201 1  Consent  Decree.  On  March  26,  2018,  Tom  Pahl,  Acting  Director  of  the 
Federal  Trade  Commission’s  Bureau  of  Consumer  Protection,  issued  the  following  statement 
regarding  reported  concerns  about  Facebook’s  privacy  practices: 

The  FTC  is  firmly  and  fully  committed  to  using  all  of  its  tools  to  protect  the  privacy 
of  consumers.  Foremost  among  these  tools  is  enforcement  action  against  companies 
that  fail  to  honor  their  privacy  promises,  including  to  comply  with  Privacy  Shield, 
or  that  engage  in  unfair  acts  that  cause  substantial  injury  to  consumers  in  violation 
of  the  FTC  Act.  Companies  who  have  settled  previous  FTC  actions  must  also 
comply  with  FTC  order  provisions  imposing  privacy  and  data  security 
requirements.  Accordingly,  the  FTC  takes  very  seriously  recent  press  reports 
raising  substantial  concerns  about  the  privacy  practices  of  Facebook.  Today,  the 
FTC  is  confirming  that  it  has  an  open  non-public  investigation  into  these  practices. 

209.  In  an  April  4,  2018  Washington  Post  article,  David  Vladeck,  who  was  the 
Director  of  the  FTC’s  Bureau  of  Consumer  Protection  when  the  Consent  Decree  issued,  stated 
that  Facebook  is  “likely  grossly  out  of  compliance  with  the  FTC  consent  decree,”  adding,  “I 
don’t  think  that  after  these  revelations  they  have  any  defense  at  all.”  In  an  April  8,  2018 
article,  Vladeck,  was  reported  as  saying  that  Facebook  may  face  fines  of  $1  billion  or  more  for 
failing  to  comply  with  the  Consent  Decree,  and  that  “[t]he  agency  will  want  to  send  a  signal . . . 
that  the  agency  takes  its  consent  decrees  seriously.” 

210.  On  May  12, 2018,  FTC  Commissioner  Chopra  issued  a  memorandum  to  all  FTC 
staff  and  commissioners  regarding  “Repeat  Offenders”  that  specifically  addresses  the 
obligations  that  corporate  officers  and  directors  have  to  remedy  the  issues  that  a  consent  order 
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is  intended  to  address,  noting  that  the  FTC’s  “orders  not  only  bind  a  firm,  but  also  its  officers.” 
The  Commissioner  suggested  in  his  recent  memorandum  that  where  a  company  violates  a 
consent  order,  “a  fair[]  allocation  of  liability  might  include  specific  recoveries  from  executives” 
and  that  “it  may  be  important  for  the  violating  company’s  board  to  exercise  any  rights  it  may 
have  to  claw  back  bonuses  and  order  the  forfeiture  of  certain  unvested  stock  options  and 
grants.”  The  Commissioner  also  noted  that  “executive  compensation  arrangements  may  need 
to  be  amended  to  reflect  a  . . .  commitment  to  compliance  with  the  law.” 

211.  The  Commissioner  noted  in  his  memorandum  that  “[wjhile  these  aggressive 
remedies  are  typically  applied  [only]  in  fraud  cases,  [the  FTC]  should  not  hesitate  to  apply 
them  against  repeat  offender  corporations  and  their  executives^]  [r]egardless  of  their  size  and 
clout[.]” 

212.  On  June  4,  2018,  Senators  Markey  and  Blumenthal  sent  a  letter  to  the  FTC  and 
noted  that  Facebook  may  have  violated  the  FTC  Consent  Decree.  “The  American  people 
deserve  to  fully  understand  with  whom  and  under  what  conditions  Facebook  provides  access  to 
user  data[,]”  they  stated.  Also  on  June  4, 201 8,  Cicilline  and  New  York  Attorney  General 
Barbara  Underwood  sent  a  letter  to  defendant  Zuckerberg  that  raised  the  issue  of  whether 

Facebook’s  data-sharing  practices  violate  the  Consent  Decree. 

E.  Defendants’  Public  Statements  to  Users  and  Investors  Alike  Were 

Materially  False  and  Misleading  With  Respect  to  the  Company’s 

Data  Security  and  Privacy  Policies 

213.  Throughout  the  relevant  period,  Defendants  emphasized  the  “security”  of 
Facebook  user  accounts  and  expressly  denied  any  “breach”  of  Facebook’s  systems  had 
occurred  that  allowed  unauthorized  persons  to  obtain  user  data,  and  promised  that  users  would 
be  notified  of  any  “breach”  of  Facebook’s  systems  or  other  attack  that  compromised 
Facebook’s  platform. 

214.  For  example,  an  October  16,  2015  post  by  Alex  Stamos  (“Stamos”),  Facebook’s 
Chief  Information  Security  Officer,  stated: 

The  security  of  people’s  accounts  is  paramount  at  Facebook,  which  is  why  we 
constantly  monitor  for  potentially  malicious  activity  and  offer  many  options  to 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

60 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


ase  4:18-cv-01792-HSG  Document  124-2  Filed  08/01/19  Page  67  of  143 


proactively  secure  your  account.  Starting  today,  we  will  notify  you  if  we  believe 
your  account  has  been  targeted  or  compromised  by  an  attacker  suspected  of 
working  on  behalf  of  a  nation-state. 

*  *  * 

While  we  have  always  taken  steps  to  secure  accounts  that  we  believe  to  have  been 
compromised,  we  decided  to  show  this  additional  warning  if  we  have  a  strong 
suspicion  that  an  attack  could  be  government-sponsored.  We  do  this  because  these 
types  of  attacks  tend  to  be  more  advanced  and  dangerous  than  others,  and  we 
strongly  encourage  affected  people  to  take  the  actions  necessary  to  secure  all  of 
their  online  accounts. 

> 

It’s  important  to  understand  that  this  warning  is  not  related  to  any  compromise 
of  Facebook’s  platform  or  systems,  and  that  having  an  account  compromised  in 
this  manner  may  indicate  that  your  computer  or  mobile  device  has  been  infected 
with  malware.  Ideally,  people  who  see  this  message  should  take  care  to  rebuild 
or  replace  these  systems  if  possible. 

To  protect  the  integrity  of  our  methods  and  processes,  we  often  won’t  be  able  to 
explain  how  we  attribute  certain  attacks  to  suspected  attackers.  That  said,  we  plan 
to  use  this  warning  only  in  situations  where  the  evidence  strongly  supports  our 
conclusion.  We  hope  that  these  warnings  will  assist  those  people  in  need  of 
protection,  and  we  will  continue  to  improve  our  ability  to  prevent  and  detect  attacks 
of  all  kinds  against  people  on  Facebook. 

215.  Defendants  also  publicly  represented  in  statements  to  various  media  outlets  that 
were  often  attributed  to  an  anonymous  “Facebook  representative’’  or  an  unidentified  Company 
“spokesman”  in  response  to  a  request  for  comment  by  the  Company  that  Facebook  monitored 
and  enforced  violations  of  its  policies.  “[Misleading  people  or  misusing  their  information  is  a 
direct  violation  of  our  policies  and  we  will  take  swift  action  against  companies  that  do, 
including  banning  those  companies  from  Facebook  and  requiring  them  to  destroy  all 
improperly  collected  data,”  a  Facebook  spokesman  said  in  a  statement  to  the  Guardian  in  2015. 

216.  Facebook’s  public  filings  with  the  SEC  indicate  that  the  Company  posts  material 
that  it  considers  to  be  disclosures  that  are  required  to  comply  with  SEC  regulations  and  are 
subject  to  federal  securities  laws  because  they  are  communications  to  investors,  on  Facebook’s 
“social  networking”  website  including  in  the  “Facebook  Newsroom”  and  on  “Mark 
Zuckerberg’s  Facebook  page.” 
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217.  These  communications  to  investors  are  posted  on  Facebook’s  “social 
networking”  website,  the  same  website  that  the  Company  uses  to  communicate  with  its  users, 
as  opposed  to  the  “Facebook  for  Developers”  website  that  the  Company  uses  to  communicate 
with  app  developers,  or  the  “Facebook  for  Business”  website  that  the  Company  uses  to 
communicate  with  marketers  and  advertisers. 

218.  Throughout  the  relevant  period,  Defendants  made,  caused  or  allowed  statements 
to  be  made  by  or  on  behalf  of  Facebook  that  emphasized  the  “security”  of  Facebook’s  social 
networking  website,  and  expressly  or  impliedly  represented  that  the  Company’s  privacy 
program  and  policies  protected  user  privacy  and  complied  with  the  FTC  Consent  Order. 

219.  Defendants  were  forced  to  acknowledge  that  Facebook  had  learned  about  the 
misappropriation  of  user  data  by  Cambridge  Analytica  by  at  least  2015.  Yet,  Defendants’ 
statements  suggested  there  had  not  been  “any  compromise  of  Facebook’s  platform  or  systems” 
in  2015,  and  Facebook  told  its  users  that  they  would  be  notified  if  and  when  the  Company 
“believe[s]  your  account  has  been  targeted  or  compromised[.]” 

220.  Defendants’  initial  statements  in  response  to  reports  in  2018  also  emphatically 
denied  that  any  “breach”  of  Facebook’s  systems  or  violation  of  its  policies  had  occurred  with 
respect  to  the  data  that  was  obtained  (through  Kogan)  by  Cambridge  Analytica. 

221 .  Although  Kogan  may  have  used  the  data  in  a  manner  that  Facebook  later  claimed 
violated  its  policies  (by  sharing  the  data  with  Cambridge  Analytica),  Defendants’  statements 
described  above  were  materially  false  and/or  misleading,  as  were  other  statements  by 
Defendants  that  omitted  and  failed  to  disclose  material  facts,  including  the  following 
information  that  was  necessary  to  make  their  statements  not  misleading  in  the  context  in  which 
they  were  made: 

•  Facebook’s  platform  and  systems  were  designed  and  intended  to  allow  “reciprocal” 
access  to  user  data; 

•  Defendants  favored  “full  reciprocity”  and  the  Company  monitored  whether  third  party 
apps  complied  with  Facebook’s  policy  of  “reciprocity”  -  i.e.,  developers  obtained 
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information  from  Facebook  about  its  users  (and  non-users)  and  were  required  to  share  the 
information  they  obtained,  via  apps  on  Facebook’s  platform,  through  Facebook’s  API  and 
features  like  Facebook  login; 

•  Facebook  did  not  have  procedures  in  place  for  auditing  and  enforcing  compliance  with  its 
policies  respecting  user  privacy; 

•  Even  if  user  data  was  obtained  in  accordance  with  Facebook’s  policies,  the  Company  was 
unable  to  ensure  that  the  data  was  not  shared  with  unauthorized  third  parties,  and  had  no 
control  over  the  data  or  how  it  was  used,  after  it  was  transferred; 

•  Facebook’s  policies  were  not  sufficient  to  inform  its  users  of  the  type  of  data  it  considered 
“personally  identifying  information”  and  that  was  “public  on  Facebook”;  and 

•  Asa  result  of  the  foregoing,  Facebook’s  platform  and  its  policies  allowed  unauthorized 
persons  to  obtain  user  data  without  their  knowledge  and  informed  consent. 

222.  Defendants’  statements  suggesting  that  Facebook  complied  with,  or  had  not 
violated,  the  FTC  Consent  Order  were  materially  false  and  misleading  for  at  least  the  following 
reasons: 

223.  First,  the  public  statements  of  Defendants  and  others  do  not  comply  with  Section 
I  of  the  Order,  which  prohibits  Facebook  from  misrepresenting  any  of  its  privacy  settings.  The 
FTC  evaluates  misrepresentations  based  on  what  consumers  reasonably  understand.  In  its 
Complaint,  the  FTC  found  that  Facebook  had  misrepresented  the  extent  of  access  that  third- 
party  apps  had  to  user  data.  After  the  Order  went  into  effect,  Facebook  continued  to  grant 
third-party  apps  the  same  level  of  access  to  user  data  as  it  had  before,  without  ever  correcting 
its  misrepresentation.  GSR,  the  company  that  transferred  data  to  Cambridge  Analytica, 
acquired  its  data  from  Facebook  in  June  2014,  two  years  after  the  Order  went  into  effect. 

224.  Second,  the  Board  failed  to  implement  and  revise  Facebook’s  policies  and  terms 
of  use  to  ensure  they  complied  with  Section  II  of  the  Order,  which  required  Facebook  to  obtain 
affirmative  express  consent  and  give  its  users  clear  and  prominent  notice  before  disclosing  their 
previously  collected  information  with  third  parties  in  a  way  that  exceeds  the  restrictions 
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imposed  by  their  privacy  settings.  As  the  FTC  found,  Facebook  granted  third-party  apps  access 
to  user  data  by  overriding  users’  privacy  settings.  After  the  Order  went  into  effect,  Facebook 
never  clearly  and  prominently  disclosed  this  practice  to  users  and  did  not  retroactively  seek 
users’  express  affirmative  consent  to  continue  disclosing  their  previously-collected  data  to 
third-party  apps. 

225.  On  April  1 9,  2018,  Senator  Blumenthal  sent  a  letter  to  the  FTC,  noting  that 
Facebook  by  default  continued  to  provide  access  to  personal  and  non-public  data  to  third-party 
apps  even  after  the  consent  decree.  As  he  did  at  the  April  10  Senate  hearing,  Senator 
Blumenthal  specifically  called  out  Facebook  for  failing  to  notice  that  Kogan  submitted  terms  of 
service  for  his  app  that  explicitly  stated  that  he  reserved  the  right  to  sell  user  data  and  would 
collect  profile  information  from  the  friends  of  those  who  downloaded  the  app.  “Even  the  most 
rudimentary  oversight  would  have  uncovered  these  problematic  terms  of  service,”  Blumenthal 
wrote.  “This  willful  blindness  left  users  vulnerable  to  the  actions  of  Cambridge  Analytica.” 

226.  PwC,  the  supposedly  “independent”  auditor  that  Facebook  retained  to  conduct 
the  audits  that  are  required  under  Section  VI  of  the  Order,  prepared  reports  about  Facebook’ s 
Privacy  Program.  According  to  PwC’s  Initial  Assessment  Report,  which  is  based  on  assertions 
by  management  (“Management  Assertions”),  Facebook’s  Privacy  Program  is  routinely 
monitored,  reviewed,  and  improved.  The  report  states,  in  relevant  part: 


Monitoring  Activities:  Members  of  Facebook’s  Legal  team  periodically  review 
the  Privacy  Program  to  ensure  it,  including  the  controls  and  procedures  contained 
therein,  remains  effective.  These  legal  team  members  also  will  serve  as  point  of 
contacts  for  control  owners  and  will  update  the  Privacy  Program  to  reflect  any 
changes  or  updates  surfaced. 

Monitoring:  Facebook’s  Privacy  Program  is  designed  with  procedures  for 
evaluating  and  adjusting  the  Privacy  Program  in  light  of  the  results  of  testing  and 
monitoring  of  the  program  as  well  as  other  relevant  circumstances.  The  Privacy 
XFN  Team  assesses  risks  and  controls  on  an  on-going  basis  through  weekly 
meetings  and  review  processes.  Members  of  Facebook’s  legal  team  support  the 
Privacy  Program  and  serve  as  points  of  contact  for  all  relevant  control  owners  to 
communicate  recommended  adjustments  to  the  Privacy  Program  based  on  regular 
monitoring  of  the  controls  for  which  they  are  responsible,  as  well  as  any  internal  or 
external  changes  that  affect  those  controls. 
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227.  The  “Management  Assertions”  and  other  statements  in  PwC’s  reports  about 

* 

Facebook’s  Privacy  Program  are  misleading  and  contradict  Defendants’  own  representations. 
For  example,  defendant  Sandberg  admitted  in  an  interview  with  Recode  Media  on  May  30, 
2018  that  Facebook  had  not  audited  Cambridge  Analytica  to  ensure  they  had  actually  deleted 
the  data.  “Looking  back,  we  definitely  wish  we  had  put  more  controls  in  place.  We  got  legal 
certification  that  Cambridge  Analytica  didn’t  have  the  data,  we  didn’t  audit  them,”  she  said. 

228.  Third.  Facebook  was  required  under  Section  IV  of  the  Order  to  establish  a 
“comprehensive  privacy  program”  that  would:  “(1)  address  privacy  risks  related  to  the 
development  and  management  of  new  and  existing  products  and  services,  and  (2)  protect  the 
privacy  arid  confidentiality  of  covered  information.”  The  privacy  program  must  be  designed  to 
prevent  “unauthorized  collection,  use,  or  disclosure  of  covered  information.”  PwC’s  Initial 
Assessment  Report,  which  is  based  on  Management  Assertions,  states  that  “Facebook  has 
implemented  technical,  physical,  and  administrative  security  controls  designed  to  protect  user 
data  from  unauthorized  access,  as  well  as  to  prevent,  detect,  and  respond  to  security  threats  and 
vulnerabilities.”  But  defendant  Zuckerberg  admitted  in  testimony  before  Congress  and  the 
British  Parliament  that  Facebook  failed  to  read  the  terms  and  conditions  of  the  GSR  app  which 
sold  the  data  to  Cambridge  Analytica. 

229.  Senator  Blumenthal,  in  his  letter  to  the  FTC  sent  on  April  1 9,  2018,  noted  that 
although  the  FTC  explicitly  put  Facebook  on  notice  about  the  privacy  risks  of  third-party  apps 
with  the  201 1  consent  decree,  the  Company  has  “continued  to  turn  a  blind  eye”  to  other  outside 
parties  that  collect  data  from  its  users,  and  its  procedures  for  verifying  that  new  apps  comply 
with  it  remain  “murky,”  Senator  Blumenthal  said  in  his  letter.  Indeed,  as  the  New  York  Times 
reported  on  June  3,  2018,  Facebook  continued  to  allow  others  besides  “third  party  apps”  to 
access  the  same  user  data  that  the  Company  purportedly  banned  when  it  revised  its  policy  in 
2015. 

230.  Fourth,  the  Consent  Decree  prohibits  Facebook  from  misrepresenting  the 
privacy  or  security  of  “covered  information”  -  broadly  defined  to  include  “photos  and  videos.” 
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The  Order  also  requires  Facebook  to  “give  its  users  a  clear  and  prominent  notice  and  obtain 
their  affirmative  express  consent”  before  disclosing  previously-collected  information.  EPIC 
and  other  consumer  privacy  groups  have  alleged  that  since  early  2018,  Facebook  has  been 
routinely  scanning  photos,  posted  by  users,  for  biometric  facial  matches  without  the  consent  of 
either  the  image  subject  or  the  person  who  uploaded  the  photo,  in  violation  of  these  provisions 
(among  other  laws). 

23 1 .  Defendants  not  only  had  the  ability  (and  responsibility)  to  change  Facebook’s 
policies  and  practices  with  respect  to  third  party  developer  access  to  user  information,  they 
were  also  well  aware  of,  and  facilitated,  this  activity  through  Facebook’s  unlawful  business 
practices  and  inadequate  privacy  policies  which  they  knew  could  cause  substantial  damage  to 
Facebook  and  potential  violations  of  the  FTC  Consent  Decree. 

232.  FTC  Commissioner  Chopra  noted  in  a  recent  memorandum  to  FTC  staff  that 
going  forward,  “[wjhen  orders  are  violated,  a  key  question  [the  FTC]  will  evaluate  ....  is 
whether  the  proposed  remedies  address  the  underlying  causes  of  the  noncompliance.”  Chopra 
said  the  FTC  will  “hold  individual  executives  accountable  for  order  violations  in  which  they 
participated,  even  if  these  individuals  were  not  named  in  the  original  orders[,]”  noting  that 
“[t]his  relief  is  expressly  contemplated  by  Fed.  R.  Civ.  P.  65(d),  which  provides  that  an 
injunction  against  a  corporation  binds  its  officers.”  Moreover,  Chopra  explained,  “this  relief  is 
important,  because  it  ensures  that  individual  executives  who  control  the  operation  of  the  firm  - 
and  not  just  shareholders  -  bear  the  costs  of  noncompliance.” 

233.  Fifth,  in  certifying  the  adequacy  of  F acebook’ s  privacy  program  and  related 
internal  controls  and  procedures,  PwC  simply  relied  on  “Management  Assertions”  about 
Facebook’s  privacy  program  and  certified,  based  on  these  representations,  that  Facebook’s 
monitoring  procedures,  policies  and  internal  controls  were  effective. 

234.  Thus  far,  PwC  has  prepared  three  assessments  that  Facebook  has  submitted  to  the 
FTC  certifying  that  Facebook’s  privacy  program  meets  or  exceeds  the  requirements  of  the  201 1 
Consent  Order. 
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235.  In  all  three  audit  reports  that  Facebook  has  submitted  to  the  FTC,  PwC  certified 
that  Facebook’ s  privacy  controls  were  operating  with  sufficient  effectiveness  to  provide 
reasonable  assurance  to  protect  the  privacy  of  covered  information  and  that  the  controls  have  so 
operated  throughout  the  reporting  periods. 

236.  PwC’s  certifications  are  based  on  purported  facts,  called  “assertions”  in  the  audit 
reports,  which  are  actually  management’s  own  assertions  that  were  admittedly  provided  to 
PwC  by  Facebook  for  the  purpose  of  the  supposedly  “independent”  audits.  These  “assertions” 
were  assumed  true  for  purposes  of  the  audit  and  were  not  determined  in  the  course  of  an 
independent  audit  conducted  by  PwC  or  confirmed  by  PwC  based  upon  reasonable  auditing 
procedures  developed  independently  of  Facebook’s  management.  Defendants  failed  to  disclose 
these  “Management  Assertions”  and  that  PwC,  in  relying  on  them,  took  them  as  “fact,”  without 
conducting  an  appropriate  investigation  and  review  of  the  information  that  was  provided  to 
determine  whether  it  was  sufficiently  reliable  and  supported  by  Facebook’s  records, 
documentation,  or  other  evidence. 

237.  According  to  the  audit  report  for  the  period  February  12, 2015  to  February  1 1, 
2017,  Facebook  constantly  enhances  or  updates  its  program  to  protect  individual/users 
information,  and  Facebook’s  Privacy  XFN  Team  assists  the  chief  officers  and  his  team  to 
review  and  provide  feedback  on  new  product  proposals  and  any  material  changes  to  existing 
products  from  a  privacy  perspective. 

238.  The  audit  report  for  the  period  August  15,  2012  to  February  11,  2013  indicates 
that  Facebook’s  Privacy  Program  was  defined  by  the  following  assertions:  responsibility  for  the 
Facebook  Privacy  Program,  privacy  Risk  Assessment,  Privacy  and  Security  awareness,  notice, 
choice,  consent,  collection  and  assess,  security  for  privacy,  third-party  developers,  service 
provider,  and  on-going  monitoring  of  the  privacy  program.  These  assertions  are  based  on  the 
following  “facts”  that  were  not  independently  verified  by  PwC: 
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•  Facebook  provides  notices  to  users  regarding  its  privacy  policies  and  procedures, 
identifies  the  purposes  for  which  personal  information  is  collected,  used,  retained 
and  disclosed. 

•  Without  users/individuals’  explicit  or  implicit  authorization,  Facebook  would  not 
disclose  users’  information  to  any-third  parties/developers; 

•  Facebook  collects  personal  information  only  for  the  purposes  identified  in  the 
notice  and  Facebook  provides  tools  for  users/individuals  to  manage  their  personal 
information. 

239.  In  its  Biennial  Report  for  the  period  from  February  12,  2015  to  February  1 1, 
2017,  PwC  stated  that  there  were  no  material  weaknesses  in  Facebook’s  internal  controls  and 
determined  that  Facebook’s  privacy  program  was  sufficient  to  comply  with  the  FTC  Consent 
Order. 

240.  Defendants’  statements  were  materially  false  and  misleading  because  they  failed 
to  disclose  that  Defendants  continued  to  operate  Facebook’s  business  in  essentially  the  same 
manner  that  led  to  the  Consent  Order  being  entered  in  the  first  place  and  were  known  to  have 
previously  made  -  and  broken  -  their  promises  with  regard  to  Facebook’s  user  privacy 
practices. 

241 .  The  fact  that  PwC  found  no  deficiencies  in  Facebook’s  internal  controls 
following  the  WhatsApp  acquisition  in  2014  is  similarly  egregious,  given  that  the  FTC 
specifically  warned  Defendants  in  2014  about  their  obligations  to  protect  the  privacy  of  their 
users  in  light  of  the  proposed  acquisition.1 

242.  Defendants  knew  (or  should  have  known)  that  once  the  data  was  exfiltrated  by  a 
third  party,  there  was  no  way  for  Facebook  to  recover  the  data  or  to  ensure  it  would  not  be 


1  See  Fed.  Trade  Comm’n  Press  Release,  FTC  Notifies  Facebook,  WhatsApp  of  Privacy 
Obligations  in  Light  of  Proposed  Acquisition,  Apr.  10,  2014,  available  at 

https://www.ftc.gov/news-events/press-releases/2014/04/ftc-notifies-facebook-whatsapp- 
privacy-obligations-light-proposed. 
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further  exposed  or  compromised  in  the  future.  Even  if  there  was,  Defendants  did  not  even 
attempt  to  secure  Facebook’s  user  data  and  failed  to  implement  any  auditing  or  enforcement 
procedures.  Instead,  Defendants  turned  a  blind  eye  to  obvious  violations  of  Facebook’s 
policies,  failed  to  ensure  that  the  Company’s  privacy  program  was  effective  and  that  their 
statements  about  Facebook’s  data  security  and  user  privacy  practices  were  not  misleading. 

243.  In  Facebook’s  written  responses  to  Congress,  Defendants  confirmed  that  they  had 
not  taken  action  against  any  third  party  apps  for  similar  data-sharing  and  extrication  practices 
as  Kogan  and  Cambridge  Analytica,  and  only  went  after  those  that  posed  a  threat  to  Facebook’s 
competitive  position.  In  response  to  a  request  for  “a  list  of  developers  that  Facebook  has  taken 
legal  action  against  for  violations  of  Facebook’s  developer  policy[,]”  the  Company  responded: 


We  use  a  variety  of  tools  to  enforce  Facebook  policies  against  violating  parties, 
including  developers.  We  review  tens  of  thousands  of  apps  per  year  and  regularly 
disapprove  noncompliant  apps  as  part  of  our  proactive  review  process. 

We  also  use  tools  like  cease-and-desist  letters,  account  suspensions,  letter 
agreements,  and  civil  litigation.  For  example,  since  2006,  Facebook  has  sent  over 
1,150  cease-and-desist  letters  to  over  1,600  targets. 

In  2017,  we  took  action  against  about  370,000  apps,  ranging  from  imposing  certain 
restrictions  to  removal  of  the  app  from  the  platform.  Moreover,  we  have  required 
parties  who  have  procured  our  data  without  authorization  to  delete  that  data. 

We  have  invested  significant  resources  in  these  efforts.  Facebook  is  presently 
investigating  apps  that  had  access  to  large  amounts  of  information  before  we 
changed  our  platform  policies  in  2014  to  significantly  reduce  the  data  apps  could 
access. 

As  of  early  June  2018,  around  200  apps  (from  a  handful  of  developers:  Kogan,  AIQ, 
Cube  You,  the  Cambridge  Psychometrics  Center,  myPersonality,  and  AIQ)  have 
been  suspended — pending  a  thorough  investigation  into  whether  they  did  in  fact 
misuse  any  data. 

Additionally,  we  have  suspended  an  additional  14  apps,  which  were  installed  by 
around  one  thousand  people.  They  were  all  created  after  2014,  after  we  made 
changes  to  more  tightly  restrict  our  platform  APIs  to  prevent  abuse.  However,  these 
apps  appear  to  be  linked  to  AIQ,  which  was  affiliated  with  Cambridge  Analytica. 

So,  we  have  suspended  them  while  we  investigate  further.  Any  app  that  refuses  to 
take  part  in  or  fails  our  audit  will  be  banned. 

1.  Defendants’  Statements  Omitted  and  Failed  to  Disclose  That 

Facebook’s  Platform  and  Policies  Allowed  Third  Parties  to  Obtain 
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Users’  Personal  Information  and  Data  Without  Their  Consent 

244.  Throughout  the  relevant  period,  Defendants  emphasized  that  Facebook’s  business 

depended  upon  maintaining  user  trust  and  falsely  assured  Facebook  users  and  investors  that  the 
Company  maintained  effective  data  security  practices  and  internal  controls  that  protected  user 
privacy  by  preventing  their  personal  information  and  data  from  being  obtained  by  third  parties 
without  their  knowledge  and  consent. 

245.  Facebook’s  Data  Use  Policy  in  2013  stated,  in  relevant  part: 

Granting  us  permission  to  use  your  information  not  only  allows  us  to  provide 
Facebook  as  it  exists  today,  but  it  also  allows  us  to  provide  you  with  innovative 
features  and  services  we  develop  in  the  future  that  use  the  information  we  receive 
about  you  in  new  ways.  While  you  are  allowing  us  to  use  the  information  we  receive 
about  you,  you  always  own  all  of  your  information.  Your  trust  is  important  to  us, 
which  is  why  we  don’t  share  information  we  receive  about  you  with  others  unless 
we  have: 

□  received  your  permission 

□  given  you  notice,  such  as  by  telling  you  about  it  in  this  policy;  or 

□  removed  your  name  and  any  other  personally  identifying  information  from  it. 

246.  Despite  this  policy,  until  2014,  developers  could  generally  launch  apps  on  the 
Facebook  Platform  without  affirmative  approval  or  review  by  Facebook.  Facebook  allowed 
third-party  app  developers  to  use  the  Facebook  API  to  download  a  user’s  friends  and 
friendships. 

247.  Oh  May  22,  2014,  Facebook  announced  an  expanded  “privacy  checkup”  tool  that 
would  enable  users  to  review  the  privacy  of  “key  pieces  of  information”  on  their  profiles,  as 
well  as  a  change  to  the  default  sharing  setting  for  new  members’  first  post  from  “public”  to 
“friends.  First-time  posters  would  also  see  a  reminder  to  choose  an  audience  for  their  first  post, 
although  the  company  stressed  that  the  new  default  “friend”  setting  would  apply  even  if  they 
didn’t  make  an  audience  choice.  “Users  will  also  still  be  able  to  change  the  intended  audience 
of  a  post  at  any  time,  and  can  change  the  privacy  of  their  past  posts  as  well,”  Facebook’s 
website  post  added. 
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248.  Defendants  represented  in  statements  on  Facebook’s  website  that  the  Company 
had  “elected”  to  make  these  changes  on  its  own,  which  was  untrue.  Facebook’s  changes  to  the 
privacy  practices  were  prompted  by  a  contested  $20  million  settlement  that  required  the 
Company  to  make  changes  to  its  policies  in  order  to  give  minor  and  adult  users  more 
information  about  how  their  names  and  likenesses  are  employed  in  connection  with  ads 
displayed  through  the  site’s  Sponsored  Stories  program. 

249.  Further,  when  Facebook  expanded  Facebook’s  Graph  API  and  developer  policies 
in  2014,  it  was  not  for  the  protection  of  its  users.  Defendants  failed  to  disclose  that  this  change 
allowed  app  developers  to  obtain  a  “read  mailbox”  permission  that  allowed  access  to  a  user’s 
inbox.  That  was  just  one  of  a  series  of  extended  permissions  granted  to  developers  under 
version  2.0  of  the  Graph  API.  A  Facebook  spokesperson  confirmed  to  The  Register  that  “[i]n 
2014,  Facebook’s  platform  policy  allowed  developers  to  request  mailbox  permissions,”  but 
tried  to  downplay  the  significance  of  the  eyebrow-raising  revelation  by  claiming  that  the 
permission  only  granted  access  to  a  user’s  inbox  with  their  express  consent,  and  was  mainly 
used  for  apps  offering  a  combined  messaging  service.  “At  the  time  when  people  provided 
access  to  their  mailboxes  -  when  Facebook  messages  were  more  of  an  inbox  and  less  of  a  real¬ 
time  messaging  service  -  this  enabled  things  like  desktop  apps  that  combined  Facebook 
messages  with  messages  from  other  services  like  SMS  so  that  a  person  could  access  their 
messages  all  in  one  place,”  the  spokesperson  said. 

2.  Defendants’  Statements  Omitted  and  Failed  to  Disclose  Material 
Facts  About  the  Acquisition  and  Monetization  of  WhatsApp 

250.  On  February  19, 2014,  Facebook  announced  that  the  Company  would  acquire 
WhatsApp,  a  messaging  platform  that  was  co-founded  by  defendant  Koum,  WhatsApp’s  CEO 
and  a  Facebook  director  until  2018,  for  approximately  $16  billion.  However,  the  true  cost  to 
the  Company  was  closer  to  $19  billion,  if  not  higher,  as  the  $16  billion  purchase  price, 
consisting  of  $4  billion  in  cash  and  184  million  shares  of  Facebook  stock  worth  approximately 
$12  billion,  did  not  include  the  46  million  restricted  stock  units  (“RSUs”)  that  Facebook  gave 
WhatsApp  employees  and  its  founders  (including  defendant  Koum),  which  were  worth 
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approximately  $3  billion  and  represented  7.9%  of  Facebook  shares  then  outstanding.  On  a 
conference  call  with  securities  analysts  held  the  same  day  as  the  announcement,  Facebook’ s 
then-CFO,  David  Ebersman,  stated  that  “[t]he  deal  was  unanimously  approved  by  the  Boards 
of  Directors  of  both  companies[.]” 

251 .  Defendants  Zuckerberg  and  Koum  discussed  the  acquisition  of  WhatsApp  on  the 

February  19,  2014  conference  call,  and  Zuckerberg’s  comments  on  the  call  made  clear  that  the 

increased  competition  Facebook  perceived  or  was  facing  from  WhatsApp  was  a  primary 

motivating  factor  behind  the  acquisition.  Zuckerberg  stated: 

In  fact,  WhatsApp  is  the  only  widely  used  app  we’ve  ever  seen  that  have  more 
engagement  in  a  higher  percent  of  people  using  it  daily  than  Facebook  itself.  After 
doubling  in  size  from  the  last  year,  more  than  450  million  people  now  use 
WhatsApp  monthly  and  more  than  one  million  new  people  are  signing  up  every 
day.  Based  on  our  experience  of  building  global  services  with  strong  growth  and 
engagement,  we  believe  WhatsApp  is  on  a  path  to  reach  over  one  billion  people 
worldwide  in  the  next  few  years.  Internet  services  that  reach  a  billion  people  are  all 
incredibly  valuable,  and  we  believe  WhatsApp  will  be  as  well. 

*  *  * 

We  expect  them  to  bring  the  same  quality  and  innovation  they  bring  to  the  rest  of 
the  products,  and  the  successful  subscription  model  they  already  have  in  place  is 
the  product  in  start.  As  Facebook  works  to  connect  the  entire  world  and  to  build  the 
infrastructure  for  global  community,  WhatsApp  will  clearly  help  accelerate  our 
progress.  Jan  and  the  team  have  built  the  product  with  a  simple,  fast,  reliable  and  a 
really  great  experience  for  people.  It’s  a  great  model  for  our  own  mobile 
development  process.  WhatsApp  also  complements  our  services  and  will  add  a  lot 
of  new  value  to  our  community.  People  use  WhatsApp  as  a  replacement  for  SMS 
to  communicate  with  their  contacts  as  well  as  small  groups  of  people.  Our 
communication  product  like  Facebook  Messenger  and  Chat  are  used  mostly  for 
chatting  with  your  Facebook  friends  and  often  sending  messages  that  aren’t 
necessarily  real-time. 


*  *  * 

Overall,  I  am  very  excited  about  this  deal.  And  I  think  it  will  be  great  for  Facebook 
and  WhatsApp  community,  as  well  as  for  both  companies.  WhatsApp  had  every 
option  in  the  world,  certainly  thrilled  that  they  chose  to  work  with  us. 

252.  Both  defendants  Zuckerberg  and  Koum  promised  that  WhatsApp’s  practices  with 
respect  to  user  data  would  not  change  following  the  acquisition.  For  example,  Zuckerberg 
stated,  “We’re  committed  to  building  and  operating  WhatsApp  independently.  Their  product 
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roadmap  is  very  exciting  and  it’s  not  going  to  change.”  Koum  apparently  trusted  Zuckerberg, 
stating,  “I  believe  that  WhatsApp  will  continue  to  operate  independently  and  autonomously. 
It’s  important  for  all  of  us  that  the  team  keep  working  with  the  pace  and  energy  of  a  start-up. 
We  will  also  assume  that  confidence  that  Facebook  calls  for  in  a  process  innovation  will  be 
great  good  [ph]  for  us.” 

253.  The  focus  on  maintaining  WhatsApp’s  practices  after  the  acquisition  was  vague, 
yet  it  was  telling  in  that  it  suggested  Defendants  knew  they  most  likely  were  the  reason  that 
WhatsApp’s  “user  engagement”  was  increasing  significantly  and  was  greater  than  Facebook’s. 
However,  defendant  Zuckerberg  downplayed  WhatsApp’s  practices  that  were  focused  on  user 
privacy  in  his  comments. 

< 

254.  In  response  to  a  question  about  “the  competitive  dynamics”  of  the  acquisition, 
Zuckerberg  stated: 

Yes,  messaging  is  a  very  competitive  space  as  you’re  saying.  I  mean  WhatsApp  I 
think  is  the  clear  global  leader  at  this.  If  you  go  country-by-country,  there  are 
countries  like  in  Korea  or  Japan  where  another  messaging  service  is  bigger,  but  if 
you  look  across  the  world,  I  think  WhatsApp  is  in  most  countries.  It’s  right  across 
Europe,  in  Latin  America,  India,  like  lot  of  places  in  Asia.  It’s  kind  of  the  clear 
leader. 

And  I  think  a  lot  of  this  gets  down  to  the  details  that  Jan  was  talking  about  in  early 
answer,  where  these  guys  just  obsessively  focused  on  simplicity  and  speed  and 
reliability.  But  when  they  go  into  a  country,  I  mean  they  don’t  rest  until  their  service 
is  faster  than  SMS,  and  as  reliable  with  obviously  all  the  disadvantages  that  come 
with  going  over  the  data  network  instead  of  the  voice  network. 

So  that’s  I  think  the  technical  advantage  that  these  guys  have.  It’s  a  company  of 
really  hardcore  engineers,  who  are  obsessing  over  perfecting  messaging,  not  adding 
a  lot  of  bloated  features  into  a  messaging  app.  And  I  think  that’s  like  the  way  that 
-  that’s  the  right  strategy.  I  think  that’s  what  people  want. 

And  over  time,  I  think  people  are  going  to  pay  for  that,  and  then  want  to  pay  for  it, 
and  will  be  happy  to  pay  for  the  best  one. 

(Emphasis  added). 

255.  In  response  to  a  question  about  plans  with  regard  to  monetization,  defendant 
Koum  promised  that  “[mjonetization  is  not  going  to  be  a  priority  for  us.”  He  and  defendant 
Zuckerberg  also  stated: 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

73 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


2ase  4:18-cv-01792-HSG 


Document  124-2  Filed  08/01/19  Page  80  of  143 


Zuckerberg: 

So  let  me  start  off,  and  then  I  guess  Jan  is  going  to  jump  in.  Our  explicit  strategy  is 
for  the  next  several  years  to  focus  on  growing  and  connecting  everyone  in  the 
world.  And  then  we  believe  that  once  we  get  to  being  a  service  that  has  billion,  two 
billion,  maybe  even  three  billion  people  one  day,  that  there  are  many  clear  ways 
that  we  can  monetize,  but  the  right  strategy  we  believe,  is  to  continue  focusing  on 
growth  and  the  product  and  succeeding  in  building  the  best  communication  tools  in 
the  world. 

So  that’s  actually  one  of  the  big  reasons  why  it  makes  sense  for  WhatsApp  to  join 
us  is  that,  as  an  independent  company,  they  wouldn’t  have  been  able  to  purely  focus 
on  growth,  whereas  now  we  can  really  help  them  out  a  lot  with  that. 

But  I’ll  hand  it  over  to,  Jan,  to  talk  about  monetization.  I  don’t  personally  think  that 
ads  are  the  right  way  of  monetized  messaging  services.  And  I  know,  Jan,  shares  this 
philosophy.  So  why  don’t  you  go  into  that? 

Koum: 

Yes,  absolutely.  I  think  I’ve  talked  to  Mark  about  it  number  of  times.  And  I  have 
talked  about  it  in  our  blog.  We  think  that  for  our  product  for  messaging, 
advertisement  is  not  going  to  serve  as  the  right  thing  to  go. 

We  feel  that  we  actually  have  a  very  solid  monetization  system  in  place  that  helps 
us  create  a  direct  relationship  with  our  user  and  our  customer.  And  WhatsApp 
really  focuses  on  growth.  Monetization  is  not  going  to  be  a  priority  for  us.  And 
this  is  why  I  actually  respect  Mark  and  his  vision  that  he  thinks  a  very  long-term 
on  everything  they  do  at  Facebook. 

They  focus  on  something  that  has  -  not  just  tomorrow,  but  something  that  is  five 
or  10  years  from  now.  And  that’s  the  same  with  our  company.  When  we’re 
talking  about  where  mobile  is  going  to  be,  not  today,  not  next  year,  but  in  2020  or 
in  2025,  and  as  we  look  forward  to  the  next  five,  10  years,  five  billion  people  will 
have  a  smartphone.  And  we  hold  potential  to  have  five  billion  users  potentially 
given  us  money  through  the  subscription  model. 

So  we  really  are  excited  about  the  growth  today  as  a  potential  of  where  it’s  going 
to  be,  five,  10  years  from  now.  And  we’re  not  really  concerned  about 
monetization  today.  We’re  focused  on  the  growth. 


(Emphasis  added). 


a.  The  FTC  Warned  Facebook  About  Potential  Violations  of  the 
Consent  Order  In  Connection  with  the  WhatsApp  Acquisition 
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256.  On  February  9,  2014,  Facebook  issued  a  press  release  announcing  the  acquisition 
of  WhatsApp,  which  defendant  Koum  co-founded  in  2009.  In  the  press  release,  defendant 
Zuckerberg  stated,  “I’ve  known  Jan  [Koum]  for  a  long  time  and  I’m  excited  to  partner  with 
him  and  his  team  to  make  the  world  more  open  and  connected.”  Defendant  Koum  said, 
“WhatsApp’ s  extremely  high  user  engagement  and  rapid  growth  are  driven  by  the  simple, 
powerful  and  instantaneous  messaging  capabilities  we  provide.  We’re  excited  and  honored  to 
partner  with  Mark  and  Facebook  as  we  continue  to  bring  our  product  to  more  people  around  the 
world.” 

257.  Defendant  Koum  stayed  on  as  WhatsApp’s  CEO  after  the  acquisition,  and 
according  to  Facebook’s  website,  he  was  “responsible  for  setting  the  overall  direction  and 
strategy  for  WhatsApp.” 

258.  In  a  letter  to  Facebook  and  WhatsApp  general  counsel  sent  on  April  10, 2014, 
Jessica  Rich,  Director  of  the  FTC’s  Bureau, of  Consumer  Protection,  noted  that  WhatsApp  has 
made  clear  privacy  promises  to  consumers,  and  that  both  companies  have  told  consumers  that 
after  any  acquisition,  WhatsApp  will  continue  its  current  privacy  practices.  “We  want  to  make 
clear  that,  regardless  of  the  acquisition,  WhatsApp  must  continue  to  honor  these  promises  to 
consumers.  Further,  if  the  acquisition  is  completed  and  WhatsApp  fails  to  honor  these 
promises,  both  companies  could  be  in  violation  of  Section  5  of  the  Federal  Trade  Commission 
(FTC)  Act  and,  potentially,  the  FTC’s  order  against  Facebook,”  the  letter  states.2 

259.  The  FTC  specifically  noted  that  the  Consent  Order  applies  equally  to  “Facebook 
and  its  subsidiaries”  and  instructed  that  “[b]efore  changing  WhatsApp’s  privacy  practices  in 
connection  with,  or  following,  any  acquisition,  you  must  take  steps  to  ensure  that  you  are  not  in 
violation  of  the  law  or  the  FTC’s  order.  First,  if  you  choose  to  use  data  collected  by  WhatsApp 


2  See  Fed.  Trade  Comm’n  Press  Release,  FTC  Notifies  Facebook,  WhatsApp  of  Privacy 
Obligations  in  Light  of  Proposed  Acquisition,  Apr.  10,  2014,  available  at 

https://www.ftc.gov/news-events/press-releases/2014/04/ftc-notifies-facebook-whatsapp- 
privacy-obligations-light-proposed. 
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in  a  manner  that  is  materially  inconsistent  with  the  promises  WhatsApp  made  at  the  time  of 
collection,  you  must  obtain  consumers’  affirmative  consent  before  doing  so.  Second,  you  must 
not  misrepresent  in  any  manner  the  extent  to  which  you  maintain,  or  plan  to  maintain,  the 
privacy  or  security  of  WhatsApp  user  data. ...  Finally,  if  you  choose  to  change  how  you  collect, 
use,  and  share  newly  collected  WhatsApp  data,  we  recommend  that  you  offer  consumers  an 
opportunity  to  opt  out  of  such  changes[.]” 

260.  “Following  the  announcement  of  the  proposed  acquisition  of  WhatsApp, 
Facebook  chief  executive  Mark  Zuckerberg  was  quoted  as  saying  ‘We  are  absolutely  not  going 
to  change  plans  around  WhatsApp  and  the  way  it  uses  user  data.’  Similarly,  a  Facebook 
spokesperson  stated  that  ‘As  we  have  said  repeatedly,  WhatsApp  will  operate  as  a  separate 
company  and  will  honor  its  commitments  to  privacy  and  security.’”  The  FTC  concluded  that 
Facebook  had  “promised  consumers  that  it  would  not  change  the  way  WhatsApp  uses  customer 
information”  and  specifically  advised  that  “any  use  of  WhatsApp ’s  subscriber  information  that 
violates  these  privacy  promises,  by  either  WhatsApp  or  Facebook,  could  constitute  a  deceptive 
or  unfair  practice  under  the  FTC  Act”  and  “could  violate  the  FTC’s  order  against  Facebook.” 

261.  On  March  12,  2018,  WhatsApp  attorneys  signed  an  “undertaking”  with  the 
Information  Commissioner  responsible  for  enforcement  of  the  Irish  Data  Protection  Act 
(“DP A”),  acknowledging  that  WhatsApp’s  “sharing]  any  personal  data  with  the  Facebook 
family  of  companies”  would  be  a  violation  of  the  DPA  because  WhatsApp  had:  (i)  “not 
identified]  a  lawful  basis  of  processing  for  any  such  sharing  of  personal  data”;  (ii)  “fail[e]d  to 
provide  adequate  fair  processing  information  to  users  in  relation  to  any  such  sharing  of 
personal  data”;  and  (iii)  “[i]n  relation  to  existing  users,  such  sharing  . . .  involved  the  processing 
of  personal  data  for  a  purpose  that  is  incompatible  with  the  purpose  for  which  such  data  were 
obtained.”  WhatsApp  “committed]”  not  to  engage  in  these  practices  only  with  respect  to  users 
in  the  European  Union,  and  WhatsApp  and  Facebook  continue  to  share  the  personal  data  of 
U.S.  users  with  each  other  and  with  other  third  party  companies. 

b.  Defendant  Koum  Resigned  From  Facebook’s  Board  and  as 
WhatsApp’s  CEO  in  the  Midst  of  the  Scandal 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

76 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


4:18-cv-01792-HSG  Document  124-2  Filed  08/01/19  Page  83  of  143 


262.  The  acquisition  of  WhatsApp  was  made  on  the  foundation  of  “no  ads,  no  games, 
and  no  gimmicks.”  However,  defendant  Zuckerberg  broke  his  promise  and  reportedly 
pressured  WhatsApp’s  founders  to  change  its  business  model  in  order  to  generate  more 
advertising  revenue.  When  defendant  Koum  complained  that  he  “didn’t  have  enough  people” 
to  implement  the  project,  Zuckerberg  dismissed  him  with,  “I  have  all  the  people  you  need,” 
according  to  one  person  familiar  with  the  conversation. 

263.  On  April  30,  2018,  defendant  Koum  publicly  announced  his  departure  from 
WhatsApp  and  resignation  from  Facebook’s  board  of  directors.  “Koum’s  exit  is  highly  unusual 
at  Facebook,”  the  Washington  Post  reported.  “The  inner  circle  of  management,  as  well  as  the 
board  of  directors,  has  been  fiercely  loyal  during  the  scandals  that  have  rocked  media  giant.  In 
addition,  Koum  is  the  sole  founder  of  a  company  acquired  by  Facebook  to  serve  on  its  board. 
Only  two  other  Facebook  executives,  Zuckerberg  and  Chief  Operating  Officer  Sheryl 
Sandberg,  are  members  of  the  board.” 

264.  Defendant  Koum  did  not  give  any  reasons  for  his  exit.  Nevertheless,  he 
explained  that  he  deeply  cared  about  the  privacy  of  communication  in  2014  when  he  sold 
WhatsApp  to  Facebook,  stating  in  a  blog  post,  “respect  for  your  privacy  is  coded  into  our 
DNA,  and  we  built  WhatsApp  around  the  goal  of  knowing  as  little  about  you  as  possible. . .  If 
partnering  with  Facebook  meant  that  we  had  to  change  our  values,  we  wouldn’t  have  done  it.” 

265.  The  split  between  Facebook  and  WhatsApp  is  considered  messy  and  expensive, 
according  to  The  Wall  Street  Journal.  “Behind  the  dishiness,  however,  is  a  very  important  story 
that  pretty  much  clears  up  any  doubt  as  to  whether  Mark  Zuckerberg  is  a  trustworthy  man  who 
keeps  his  promises  -  or  a  profit-obsessed  machine  who’s  much  stronger  on  greed  than  he  is  on 
morals.”  While  Zuckerberg  told  stock  analysts  that  he  and  Koum  agreed  that  advertising 
wasn’t  the  right  way  to  make  money  from  messaging  apps,  it  was  Zuckerberg’ s  decision  alone, 
but  he  broke  his  promise. 

266.  According  to  the  Washington  Post,  which  spoke  to  “people  familiar  with  internal 
discussions”  over  Koum’s  departure,  there  were  tensions  with  Facebook  over  WhatsApp’s  end- 
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to-end  encryption,  which  ensures  that  messages  can’t  be  intercepted  and  read  by  anyone 
outside  of  the  conversation,  including  by  WhatsApp  or  Facebook.  Koum  and  other  WhatsApp 
executives  believed  that  Facebook’ s  desire  to  make  it  easier  for  businesses  to  use  its  tools 
would  require  weakening  some  of  the  encryption. 

267.  Brian  Acton  (“Acton”),  who  co-founded  WhatsApp  with  Koum  in  2009,  left 
Facebook  in  November  of  2017,  according  to  the  New  York  Times.  Acton  later  became  the 
executive  chairman  of  the  Signal  Foundation,  the  nonprofit  that  has  run  the  encrypted 
communication  app  Signal,  and  he  personally  invested  $50  million  into  the  project  that  focus 
on  the  development  of  privacy- focused  apps.  On  March  20,  2018,  Acton  wrote  on  twitter  five 
days  after  the  Cambridge  Analytica  scandal,  “It  is  time.  #deletefacebook”  to  support  the  chorus 
of  the  #deletefacebook  movement,  Techcrunch  reported. 

268.  Both  Acton  and  defendant  Koum  are  purportedly  big  believers  in  privacy,  and 
that’s  the  reason  why  WhatsApp  insisted  no  ads  and  operated  independently  even  though 
Facebook  scrapped  the  99-cent  annual  charge  to  prevent  WhatsApp  from  generating  revenue, 
according  to  the  Washington  Post. 

269.  Former  Facebook  manager  Parakilas  told  the  New  York  Times,  “Jan  and  Brian’s 
departures  mean  that  Facebook,  WhatsApp  and  Instagram  are  all  controlled  even  more  tightly 
by  a  single  person  -  Mark  Zuckerberg;  this  centralized  control  is  bad  for  the  users  of  all  of 
these  products.” 

3.  Defendants’  Statements  Omitted  and  Failed  to  Disclose  Facebook’s 
Secret  Agreements  With  Device  Manufacturers 

270.  On  June  3, 2018,  an  article  published  by  The  New  York  Times  reported  that 
Facebook  had  entered  into  agreements  over  the  past  decade  with  at  least  60  device  makers, 
including  Apple,  Amazon,  BlackBerry,  Microsoft  and  Samsung,  that  allowed  them  to  access 
vast  amounts  of  Facebook  information,  including  data  about  users’  friends  who  had  blocked 
such  third-party  access.  These  data-sharing  partnerships,  which  Facebook  entered  into  as  early 
as  2007,  gave  these  companies  the  ability  to  offer  “features”  of  the  social  network,  such  as 
messaging,  “like”  buttons,  and  friends  (contacts)  lists,  on  their  own  websites  and  mobile 
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devices.  The  Times  reported  that  Facebook  provided  mechanisms  for  certain  phone  and  device 
manufacturers  to  build  software  accessing  user  data,  supposedly  to  integrate  Facebook  features 
before  app  markets  came  into  widespread  use. 

271 .  The  following  day,  the  Times  reported  that  Facebook  has  similar  data-sharing 
agreements  Chinese  telecommunications  companies,  including  Huawei,  Lenovo,  OPPO,  and 
TCL.  Notably,  Facebook  and  its  subsidiaries  Instagram  and  WhatsApp  have  been  blocked  by 
the  Chinese  government  since  2009,  and  the  Pentagon  has  recently  banned  the  use  of  devices 
made  by  Huawei  on  U.S.  military  bases,  citing  national  security  concerns. 

272.  Facebook’s  Vice  President  of  Product  Partnerships,  hne  Archibong 
(“Archibong”),  also  addressed  the  agreements  in  a  Facebook  Newsroom  post  titled  “Why  We 
Disagree  With  The  New  York  Times.”  According  to  Archibong,  “in  the  early  days  of  mobile,” 
Facebook  had  built  a  set  of  private  APIs  that  allowed  companies  like  Apple,  Amazon  and  HTC 
to  “recreate  Facebook-like  experiences  for  their  individual  devices  or  operating  systems”  for 
users  who  weren’t  able  to  put  a  Facebook  app  on  their  device. 

273.  The  Company’s  representatives  claimed  that  Facebook  had  already  decided  to 
start  winding  down  these  arrangements  in  April  2018,  but  did  not  explain  why  they  had  never 
previously  been  disclosed,  particularly  during  defendant  Zuckerberg’s  testimony  before 
Congress.  He  also  disputed  the  assertion  that  this  access  went  beyond  what  users  had  agreed  to 
or  were  expecting. 

274.  Indeed,  defendant  Zuckerberg  did  not  even  mention  the  contracts  with  other  third 
party  companies  in  his  testimony.  There  are  two  kinds  of  arrangements  that  Facebook  has  that 
are  supposedly  “winding  down”  because  both  appear,  unsurprisingly,  to  violate  Defendants’ 
promises  to  protect  user  privacy  (and  perhaps,  the  Consent  Decree). 

275.  In  PwC’s  Initial  Assessment  Report,  Facebook’s  Control  Activity  with  regard  to 
Service  Providers  states,  “The  privacy  policies  of  Facebook  and  Instagram  contain  a  section 
that  ‘informs  users  that  the  information  Facebook  and  Instagram  receive  ipay  be  shared  with 
service  organizations  when  a  user  signs  up  for  Facebook  and  Instagram  accounts.”  The 
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unredacted  portions  of  the  report  do  not  disclose  that  Facebook  apparently  referred  to  but  did 
not  disclose  that  these  multinational  corporations  are  the  “service  providers”  with  which 
Facebook  maintained  data  sharing  agreements. 

276.  Although  other  companies  are  also  referred  to  in  the  report,  they  are  “Facebook 
Experience  application  developers”  that  “must  read  and  sign-off  on  the  Extended  API 
Addendum  (the  ‘Addendum’),  or  . . .  the  terms  and  conditions  for  a  developer’s  adherence  to 
Facebook’s  Platform  Policies,  Statement  of  Rights  and  Responsibilities  and  data  policies  and 
procedures”  that  apply  to  third  party  app  developers  like  Kogan,  who  were  supposedly  required 
to  follow  the  same  policies  that  Defendants  did  not  enforce. 

277.  Mobile  device  manufacturers  like  Apple  and  Huawei,  however,  are  subject  to 
different  “Service  Provider  Contracts”  that,  according  to  the  Initial  Assessment  Report,  “may 
be  terminated  if  Facebook  identifies  misuse  of  user  information  (based  on  violations  of  the 
Statement  of  Rights  and  Responsibilities  and/or  the  vendor  security  policy).” 

278.  Defendants  failed  to  disclose  Facebook’s  secret  agreements  with  mobile  device 
manufacturers  that  have  been  in  effect  since  2012.  Defendants  also  did  not  disclose  that  they 
failed  to  enforce  Facebook’s  platform  policies,  which  would  similarly  provide  users  with 
essentially  no  protection  from  the  exfiltration  of  their  data. 

279.  Defendants’  data  sharing  agreements  with  third  party  companies  may  have 
exposed  Facebook  to  liability  for  violating  the  Consent  Decree.  Under  the  Consent  Decree, 
Facebook  is  required  to  obtain  permission  before  sharing  a  user’s  private  information  in  a  way 
that  exceeds  that  user’s  existing  privacy  settings.  The  Consent  Decree  defines  “third  party”  to 
include  a  host  of  other  individual  entities,  but  it  exempts  “service  providers]”  who  help 
Facebook  carry  out  basic  functions  of  its  site. 

280.  PwC’s  reports  to  the  FTC  indicate  that  the  Company’s  Privacy  Program 

encompasses  these  “service  providers.”  The  Initial  Assessment  Report  states,  in  relevant  part: 

Service  Providers:  Facebook  has  implemented  controls  with  respect  to  third-party 
service  providers,  including  implementing  policies  to  select  and  retain  service 
providers  capable  of  appropriately  protecting  the  privacy  of  covered  information 
received  from  Facebook.  Facebook’s  Security  team  has  a  process  for  conducting 
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due  diligence  on  service  providers  who  may  receive  covered  information  in  order 
to  evaluate  whether  their  data  security  standards  are  aligned  with  Facebook’s 
commitments  to  protect  covered  information. 

As  part  of  the  due  diligence  process,  Facebook  asks  prospective  service  providers 
to  complete  a  security  architecture  questionnaire  or  vendor  security  questionnaire 
to  assess  whether  the  provider  meets  Facebook’s  functional  security  requirements 
to  protect  the  privacy  of  user  data.  Based  upon  the  service  provider’s  response  to 
the  vendor  security  questionnaire  and  other  data  points,  Facebook’s  Security  team 
determines  whether  further  security  auditing  is  required. 

Facebook  partners  with  an  outside  security  consulting  firm  to  conduct  security 
audits,  which  may  include  testing  of  the  service  provider’s  controls,  a  vulnerability 
scanning  program,  a  web  application  penetration  test,  and/or  a  code  review  for 
security  defects.  Facebook  also  has  a  contract  policy  which  governs  the  review, 
approval,  and  execution  of  contracts  for  Facebook. 

281 .  Accordingly,  after  it  was  revealed  that  Facebook  has  data  sharing  agreements 
with  companies  like  Apple  and  Huawei,  Facebook  representatives  attempted  to  distinguish 
those  agreements  from  the  developer  policies  that  allowed  third  party  apps  to  obtain  Facebook 
information  and  user  data.  According  to  The  New  York  Times,  Facebook  officials  called  the 
Company’s  partnerships  with  device  manufacturers  “private  data  channels”  and  said  they  did 
not  violate  the  Consent  Order  because  “the  company  viewed  its  hardware  partners  as  ‘service 
providers,’  akin  to  a  cloud  computing  service  paid  to  store  Facebook  data  or  a  company 
contracted  to  process  credit  card  transactions.” 

4.  Defendants’  Statements  Omitted  and  Failed  to  Disclose  Facebook’s 
Adjudicated  Violations  of  Law 

a.  The  German  Supreme  Court  Declared  Facebook’s  “Friend 
Finder”  Feature  Unlawful  in  2016 

282.  In  February  2016,  the  German  Supreme  Court  declared  the  Friend  Finder  feature 
on  Facebook  to  be  unlawful.  The  court  found  that  the  service,  which  allows  the  social 
networking  giant  to  access  users’  contacts  and  send  emails  to  non-users,  was  not  adequately 
explained  to  consumers  and  amounted  to  harassing  advertising. 

283 .  Facebook’s  users  did  not  provide  the  same  information  to  Facebook  that  was 
ultimately  used  for  targeting  advertisements  -  while  it  was  developed  with  user  data,  this  data 
was  aggregated  and  ultimately  new  information  was  generated  through  Facebook’s  algorithm 
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that  was  used  for  targeting  purposes.  Because  this  was  not  the  same  information  that  Facebook 
users  had  provided,  they  did  not  (and  could  not)  know  the  information  existed,  let  alone  was 
being  shared  or  used  for  any  purpose.  Facebook’s  users  did  not,  because  they  could  not, 
consent  to  such  information  being  shared  with  third  parties  or  used  for  targeted  advertising. 
Thus,  Facebook’s  users  did  not  implicitly  or  explicitly  consent  to  Facebook’s  practices. 

b.  The  Spanish  Agency  for  Data  Protection  Fined  Facebook  €1.2 
Million  Euros  in  2017 

284.  On  September  1 1,  2017,  the  Spanish  Agency  for  Data  Protection  (“AEPD”) 
announced  that  it  had  fined  Facebook  €1 .2  million  euros  for  violating  data  protection 
regulations  following  its  investigation  to  determine  whether  the  data  processing  carried  out  by 
the  Company  complied  with  the  data  protection  regulations.  The  AEPD  stated  that  its 
investigation  made  it  possible  to  verify  that  Facebook  does  not  inform  the  users  in  a 
comprehensive  and  clear  way  about  the  data  that  it  will  collect  and  the  treatments  that  it  will 
carry  out  with  them,  but  that  it  is  limited  to  giving  some  examples.  In  particular,  the  AEPD 
found  that  Facebook  collects  other  data  derived  from  the  interaction  carried  out  by  users  on  the 
platform  and  on  third-party  sites  without  them  being  able  to  clearly  perceive  the  information 
that  Facebook  collects  about  them  or  with  what  purpose  they  are  going  to  use  it. 

285.  The  AEPD  also  found  that  the  privacy  policy  of  Facebook  contains  generic  and 
unclear  expressions,  and  requires  access  to  a  multitude  of  different  links  to  know  it.  Further, 
the  AEPD  concluded  that  the  Company  makes  an  inaccurate  reference  to  the  use  it  will  make  of 
the  data  it  collects,  so  that  a  Facebook  user  with  an  average  knowledge  of  the  new  technologies 
does  not  become  aware  of  the  data  collection  or  storage  and  subsequent  treatment,  or  what  they 
will  be  used  for. 

c.  The  French  Data  Protection  Authority  Fined  Facebook  its 
Maximum  Allowable  Fine  in  2017 

286.  In  May  2017,  the  French  data  protection  authority  fined  Facebook  its  maximum 
allowable  fine  of  €150,000  for  similar  violations  claimed  by  the  Spanish  authorities.  Facebook 
had  built  up  “a  massive  compilation  of  personal  data  of  internet  users  in  order  to  display 
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targeted  advertising,”  complained  the  Commission  Nationale  de  Hnformatique  et  des  Libertes. 
“It  collected  data  on  the  browsing  activity  of  internet  users  on  third-party  websites,  via  the 
‘datr’  cookie,  without  their  knowledge.” 

d.  A  German  Court  Found  Facebook’s  Default  Settings  are 
Illegal  and  Facebook’s  Terms  of  Service  are  Invalid  to  Obtain 
Consent  in  2018 

287.  On  February  12,  201 8,  a  German  court  found  that  Facebook’s  failure  to  obtain 
users’  informed  consent  before  collecting  their  data  was  illegal.  The  Berlin  Regional  Court 
found  that  Facebook  flouted  Germany’s  data  protection  law  by  turning  data  sharing  settings  on 
by  default.  One  preactivated  setting  on  Facebook’s  smartphone  app  shared  users’  locations  to 
the  people  they  are  chatting  with,  the  court  said.  The  Company  also  preticked  a  box 
authorizing  search  engines  to  show  links  to  user  profiles  in  search  results,  making  it  easier  for 
anyone  to  find  someone’s  personal  profile,  the  ruling  said. 

288.  The  court  found  that  eight  clauses  in  Facebook’s  terms  of  service  were  invalid, 

f 

including  a  declaration  that  users  consented  to  the  company  using  their  names  and  profile 
pictures  “for  commercial,  sponsored  or  related  content”  or  sending  their  data  to  the  United 
States. 

e.  Facebook  Was  Ordered  to  Stop  Tracking  Internet  Usage  and 
Faces  Up  to  €100  Million  in  Fines 

289.  On  February  16,  2018,  a  Belgian  court  ordered  Facebook  to  stop  tracking  Belgian 
citizens’  online  activity  on  third-party  websites  —  or  face  up  to  €100  million  ($125  million)  in 
fines.  Facebook  tracks  the  movements  of  visitors  to  outside  websites  by  installing  cookies, 
social  plug-ins  like  its  “like”  button,  or  so-called  pixels,  which  are  invisible  to  the  naked  eye, 
the  Belgian  Privacy  Commission  said.  The  software  tracks  even  those  who  do  not  have 
Facebook  accounts,  the  privacy  watchdog  alleged  in  a  suit  filed  in  2015. 

290.  The  Brussels  Court  of  First  Instance  sided  with  the  commission,  ruling  that 
Facebook  “insufficiently”  discloses  what  kind  of  data  it  collects,  what  it  does  with  the  data  and 
how  long  it  stores  it.  Facebook  does  not  do  enough  to  get  users’  consent,  the  court  said  in  a 
Dutch-language  statement.  The  court  threatened  Facebook  with  fines  of  up  to  €250,000  a  day, 
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or  up  to  €100  million  in  total,  if  it  does  not  stop  tracking  Belgians  and  delete  all  data  it  has 
already  gathered  using  the  illegal  methods. 

VII.  DEFENDANTS  AUTHORIZED  MANIPULATIVE  SHARE  REPURCHASES 
AND  FALSE  AND  MISLEADING  STATEMENTS  THAT  ARTIFICIALLY 
INFLATED  FACEBOOK’S  STOCK  PRICE 

291 .  California  Corporations  Code  section  25400  prohibits  conduct  designed  to 
manipulate  stock  price  through  fraudulent  practices  that  are  intended  to  mislead  investors  by 
artificially  creating  market  activity  in  a  security.  Specifically,  section  25400  makes  it  unlawful 
for  any  person  in  California  “[t]o  effect,  alone  or  with  one  or  more  other  persons,  a  series  of 
transactions  in  any  security  creating  actual  or  apparent  active  trading  in  such  security  or  raising 
or  depressing  the  price  of  such  security,  for  the  purpose  of  inducing  the  purchase  or  sale  of 
such  security  by  others”  and  “to  make,  for  the  purpose  of  inducing  the  purchase  or  sale  of  such 
security  by  others,  any  statement  which  was,  at  the  time  and  in  the  light  of  the  circumstances 
under  which  it  was  made,  false  or  misleading  with  respect  to  any  material  fact,  or  which 
omitted  to  state  any  material  fact  necessary  in  order  to  make  the  statements  made,  in  the  light 
of  the  circumstances  under  which  they  were  made,  not  misleading,  and  which  he  knew  or  had 
reasonable  ground  to  believe  was  so  false  or  misleading.”  Corp.  Code,  §  25400. 

292.  Section  25500  further  provides  that  “Any  person  who  willfully  participates  in  any 
act  or  transaction  in  violation  of  Section  25400  shall  be  liable  to  any  other  person  who 
purchases  or  sells  any  security  at  a  price  which  was  affected  by  such  act  or  transaction  for  the 
damages  sustained  by  the  latter  as  a  result  of  such  act  or  transaction.”  Corp.  Code,  §  25500. 

293.  California  Corporations  Code  section  25401  similarly  prohibits 
misrepresentations  in  connection  with  the  purchase  or  sale  of  securities  that  occurs  in  the  State 
of  California,  and  section  25501  provides  that  “[a]ny  person  who  violates  Section  25401  shall 
be  liable  to  the  person  who  purchases  a  security  from  him  or  sells  a  security  to  him, . . .  either 
for  rescission  or  for  damages  . . .,  unless  the  defendant  proves  that  the  plaintiff  knew  the  facts 
concerning  the  untruth  or  omission  or  that  the  defendant  exercised  reasonable  care  and  did  not 
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know  (or  if  he  had  exercised  reasonable  care  would  not  have  known)  of  the  untruth  or 
omission.”  Corp.  Code,  §  25501. 

294.  Throughout  the  relevant  period,  Defendants  issued,  and  caused  the  Company  to 
issue,  statements  that,  in  light  of  the  practices  detailed  above,  were  materially  false  or 
misleading  when  made.  Defendants’  misrepresentations  artificially  inflated  the  price  of 
Facebook  shares,  causing  the  Company  to  purchase  shares  at  artificially  inflated  prices,  through 
its  share  repurchase  program  and  subsequent  authorizations  that  were  approved  by  Facebook’s 
Board. 

A.  Facebook’s  Board  Approved  Facebook’s  Share  Repurchases  and  Increased 

Authorizations  Totaling  More  Than  $24  Billion 

295.  On  November  18, 2016,  with  full  knowledge  of  the  exfiltration  and  unauthorized 
use  of  user  data  and  the  undisclosed  deviation  of  its  policies,  as  described  above,  Facebook’s 
Board  authorized  the  Company  to  repurchase  $6  billion  of  its  own  shares  of  Class  A  common 
stock.  The  share  repurchases  that  took  place  pursuant  to  the  authorization  began  in  2017,  and 
were  the  first  in  Facebook’s  history  since  becoming  a  public  company. 

296.  According  to  Facebook’s  2017  Annual  Report,  Facebook  repurchased 
approximately  1 3  million  Class  A  common  shares  for  an  aggregate  amount  of  approximately 
$2.07  billion  in  2017.  Defendants  subsequently  disclosed  that  the  Company  “completed 
repurchases  under  the  original  authorization  to  purchase  up  to  $6.0  billion  of  our  Class  A 
common  stock  during  the  second  quarter  of  2018”  -  i.e.,  Facebook  repurchased  nearly  4  billion 
worth  of  its  shares  in  just  a  few  months  -  right  before  the  Cambridge  Analytica  incident  was 
publicly  revealed  at  the  end  of  March  2018. 

297.  Facebook’s  Board  increased  the  authorization  for  the  share  repurchases  by  an 
additional  $9  billion  in  April  2018,  which  were  completed  before  the  year’s  end. 

298.  Facebook’s  Board  then  authorized  yet  another  $9  billion  of  share  repurchases  in 
December  2018,  as  disclosed  in  the  Company’s  2018  Annual  Report  on  Form  10-K  filed  with 
the  SEC  on  January  31,  2019  (the  “2018  Form  10-K”). 
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299.  By  the  end  of  2018,  Facebook  had  repurchased  shares  of  its  Class  A  common 
stock  which  were  completed  during  the  fourth  quarter  of  2012. 

300.  The  2018  Form  10-K,  which  was  signed  by  all  of  the  Individual  Defendants  on 
Facebook’s  Board  at  the  time,  disclosed  the  following  regarding  the  share  repurchase  program: 

In  November  2016,  our  board  of  directors  authorized  a  share  repurchase  program 
that  commenced  in  January  2017  and  does  not  have  an  expiration  date.  We 
completed  repurchases  under  the  original  authorization  to  purchase  up  to  $6.0 
billion  of  our  Class  A  common  stock  during  the  second  quarter  of  2018. 

In  April  2018,  the  authorization  for  the  repurchase  of  our  Class  A  common  stock 
was  increased  by  an  additional  $9.0  billion,  and  we  completed  repurchases  under 
this  authorization  during  the  fourth  quarter  of  201 8. 

In  December  2018,  our  board  of  directors  authorized  an  additional  $9.0  billion  of 
repurchases  under  this  program,  all  of  which  remained  available  for  future 
repurchases  as  of  December  31,  2018.  The  timing  and  actual  number  of  shares 
repurchased  depend  on  a  variety  of  factors,  including  price,  general  business  and 
market  conditions,  and  other  investment  opportunities,  and  shares  may  be 
repurchased  through  open  market  purchases  or  privately  negotiated 
transactions,  including  through  the  use  of  trading  plans  intended  to  qualify 
under  Rule  10b5-l  under  the  Exchange  Act. 

301.  Defendants  also  disclosed  in  the  2018  Form  1 0-K  that  substantially  all  of 
Facebook’s  “cash  used  in  financing  activities  during  2018“  and  the  majority  in  2017  was  spent 
on  share  repurchases.  Specifically: 

Cash  used  in  financing  activities  during  2018  consisted  of  $12.88  billion  paid  for 
repurchases  of  our  Class  A  common  stock,  and  $3.21  billion  of  taxes  paid  related 
to  net  share  settlement  of  equity  awards,  offset  by  a  $500  million  overdraft  in  cash 
pooling  entities.  The  increase  in  cash  used  in  financing  activities  during  2018 
compared  to  2017  was  mostly  due  to  an  increase  in  repurchases  of  our  Class  A 
common  stock,  partially  offset  by  an  increase  in  overdraft  balances  in  cash  pooling 
entities. 

Cash  used  in  financing  activities  during  2017  mostly  consisted  of  $3.25  billion  of 
taxes  paid  related  to  net  share  settlement  of  equity  awards,  and  $1.98  billion  paid 
for  repurchases  of  our  Class  A  common  stock.  The  increase  in  cash  used  in 
financing  activities  during  2017  compared  to  2016  was  mostly  due  to  taxes  paid 
related  to  net  share  settlement  of  equity  awards  and  repurchases  of  our  Class  A 
common  stock  that  commenced  in  2017. 

302.  In  conducting  these  share  repurchases,  Defendants  falsely  signaled  to  the  public 
that  they  believed  Facebook  shares  were  undervalued  and  that  the  repurchases  were  the  best 
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use  of  the  Company’s  cash.  The  share  repurchases  also  had  the  effect  of  growing  the 
Company’s  earnings  per  share — as  share  repurchases  lower  the  number  of  shares  outstanding, 
on  which  earnings  per  share  are  based — as  well  as  its  return  on  assets,  return  on  equity,  and 
other  metrics.  Together,  these  actions  helped  inflate  Facebook’s  share  price. 

B.  Defendants’  Materially  False  and  Misleadin2  Statements  and  Omissions 

Caused  Facebook’s  Stock  to  Trade  at  Artificially  Inflated  Prices.  Which  the 

Company  (Over)  Paid  to  Repurchase  Its  Shares 

303.  During  the  time  of  the  share  repurchases,  Defendants  knowingly  or  recklessly 
made  materially  false  or  misleading  statements  and/or  failed  to  disclose  material  information 
regarding  the  Company’s  user  privacy  practices  and  the  Cambridge  Analytica  incident. 

304.  Defendants  also  made  false  or  misleading  statements  or  omissions  relating  to  its 
internal  controls  and  risks  in  Facebook’s  SEC  filings.  For  example,  Facebook’s  2015,  2016 
and  2017  Annual  Reports  signed  by  Defendants  each  contain  approximately  20  pages  of  risk 
disclosures,  yet  the  only  reference  to  the  unauthorized  use  of  user  information  refers  to  the 
mere  risk  of  it  happening  in  the  future,  obfuscating  the  fact  that  such  unauthorized  use  had 
already  occurred  and  on  a  massive  scale  impacting  tens  of  millions  of  Facebook  users.  The 
Annual  Reports  falsely  contain  certifications  that  Facebook’s  internal  controls  are  effective. 
Defendants’  SEC  filings  also  falsely  represented  that  Facebook  maintained  robust  privacy 
policies  and  risk  management  system  to  protect  user  data,  and  that  the  Board  and  senior 
executives  had  overall  and  ultimate  responsibility  for  the  management  of  risk. 

305.  Defendants’  statements  (including  those  contained  in  Facebook’s  SEC  filings 
described  above)  were  materially  false  and  misleading,  and  failed  to  disclose  material 
information,  for  the  reasons  stated  above,  including  the  fact  that  Facebook  had  already 
experienced  the  unauthorized  access  and  use  of  user  information,  deviated  from  its  own  policy 
to  restrict  access  to  user  information,  and  failed  to  implement  and  maintain  adequate  risk 
controls  at  the  Company. 

306.  In  repurchasing  shares  in  connection  with  the  stock  repurchase  program, 
Facebook  relied  on  Defendants’  false  or  misleading  statements,  which  were  reflected  in  the 
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stock  price  of  Facebook’s  shares  that  were  trading  in  the  market,  and  Facebook  paid  the  market 
price  for  shares  of  Facebook  stock  that  the  Company  repurchased  during  the  relevant  period 
pursuant  to  the  stock  repurchase  program  and  authorizations  that  were  approved  by  Facebook’s 
Board. 

307.  The  price  of  Facebook’s  common  stock  was  artificially  inflated  as  a  result  of 
Defendants’  materially  false  and  misleading  statements  and  omissions  identified  above. 
Defendants  engaged  in  a  scheme  to  deceive  the  market  and  a  course  of  conduct  that  operated  as 
a  fraud  or  deceit  on  Facebook,  which  repurchased  shares  at  artificially  inflated  prices.  When 
Defendants’  prior  misrepresentations  and  fraudulent  conduct  were  disclosed  and  became 
apparent  to  the  market,  the  price  of  Facebook  stock  fell  as  the  prior  artificial  inflation 
dissipated. 

308.  On  February  1 ,  201 8,  Facebook  filed  with  the  SEC  a  Registration  Statement  on 
Form  S-8  which  registered  42,000,000  shares  of  Facebook  Class  A  common  stock  that  were 
reserved  for  issuance  under  Facebook’s  2012  Equity  Incentive  Plan  for  sale  at  a  proposed 
maximum  offering  price  per  share  of  $1 85.01,  which  was  estimated  based  on  the  average  of  the 
high  and  low  prices  of  Facebook  common  stock  as  reported  on  NASDAQ  on  January  30,  3018, 
for  a  proposed  maximum  aggregate  offering  price  of  $7,770,420,000.00.  The  Registration 
Statement  stated  that  it  “shall  also  cover  any  additional  shares  of  Facebook  Class  A  common 
stock  that  become  issuable  in  respect  of  the  securities  identified  [in  the  Registration  Statement] 
by  reason  of  any  stock  dividend,  stock  split,  recapitalization  or  other  similar  transaction 
effected  without  [Facebook’s]  receipt  of  consideration  that  results  in  an  increase  in  the  number 
of  the  outstanding  shares  of  the  [Facebook]  Class  A  common  stock.” 

309.  Facebook’s  2018  Form  10-K  further  stated  that  the  Company’s  “shares  may  be 
repurchased  through  open  market  purchases  or  privately  negotiated  transactions,  including 
through  the  use  of  trading  plans  intended  to  qualify  under  Rule  10b5-l  under  the  Exchange 
Act.” 

VIII.  AT  THE  SAME  TIME  FACEBOOK  WAS  REPURCHASING  ITS  SHARES, 
DEFENDANTS  ZUCKERBERG,  SANDBERG  AND  KOUM  SOLD  THEIR 
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SHARES  AT  PRICES  THEY  KNEW  WERE  ARTIFICIALLY  INFLATED 

310.  Corporations  Code  section  25402  provides  that  “[i]t  is  unlawful  for  . . .  any  person 

who  is  an  officer,  director  or  controlling  person  of  an  issuer  or  any  other  person  whose 
relationship  to  the  issuer  gives  him  access,  directly  or  indirectly,  to  material  information  about 
the  issuer  not  generally  available  to  the  public,  to  purchase  or  sell  any  security  of  the  issuer  in 
this  state  at  a  time  when  he  knows  material  information  about  the  issuer  gained  from  such 
relationship  which  would  significantly  affect  the  market  price  of  that  security  and  which  is  not 
generally  available  to  the  public,  and  which  he  knows  is  not  intended  to  be  so  available,  unless 
he  has  reason  to  believe  that  the  person  selling  to  or  buying  from  him  is  also  in  possession  of 
the  information.”  Corp.  Code,  §  25402. 

311.  At  the  same  time  F acebook  was  repurchasing  shares  of  its  stock  in  20 1 7, 20 1 8, 
and/or  2019,  certain  of  the  Individual  Defendants  took  advantage  of  the  artificial  inflation  of 
Facebook’s  shares  caused  by  the  false  and  misleading  statements  and  omissions  described 
above,  selling  over  $1  billion  worth  of  their  own  personally  held  shares,  as  set  forth  herein. 

312.  At  the  time  of  these  stock  transactions,  each  of  the  Individual  Defendants  was  in 
possession  of  and  had  access  to  material,  non-public  information  regarding,  among  other 
things:  (i)  Facebook’s  violations  and/or  potential  violations  of  various  state,  federal  and  foreign 
laws;  (ii)  Facebook’s  failure  to  comply  with  the  terms  of  the  FTC  consent  order;  (iii) 
Facebook’s  policies  relating  to  user  privacy  and  the  use  of  Facebook’s  platform,  changes  to 
those  policies  and  the  reasons  for  such  changes,  violations  of  those  policies,  and  the 
Company’s  failure  to  monitor  compliance  with  those  policies  and  to  enforce  those  policies;  (iv) 
Facebook’s  undisclosed  data  collection  practices  and  its  use  of  user  data  for  targeted 
advertising  and  other  commercial  purposes;  (v)  Facebook’s  platform  design  and  the  ability  of 
third  party  apps  to  obtain  user  and  non-user  data  via  Facebook’s  platform;  (vi)  Facebook’s 
data-sharing  agreements  with  third  party  companies  and  device  manufacturers,  and  the  ability 
of  those  companies  to  obtain  user  and  non-user  data  via  Facebook’s  platform;  and  (vii) 
Facebook’s  targeted  advertising  business  and  revenues  derived  therefrom.  Thus,  the  Individual 
Defendants’  knew  or  should  have  known  that  Facebook’s  stock  was  artificially  inflated  due  to 
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the  failure  to  disclose  material  information  regarding  the  foregoing,  at  the  time  the  Insider 
Selling  Defendants  sold  their  shares  of  Facebook  stock  and  Facebook  repurchased  shares  of  its 
stock,  pursuant  to  the  program  and  increased  authorizations  that  the  Individual  Defendants 
approved  and/or  effectuated,  as  alleged  herein. 

313.  Defendants  were  required  to  disclose  to  shareholders  “material  information,”  the 
kind  of  information  that  an  investor  would  want  to  know  to  protect  their  investment.  The  SEC 
issued  guidance  on  public  reporting  of  cybersecurity  incidents,  noting  that  the  commission 
“encourages  companies  to  continue  to  use  Form  8-K  or  Form  6-K  to  disclose  material 
information  promptly,  including  disclosure  pertaining  to  cybersecurity  matters.” 

314.  In  the  2017  and  2018  Proxy  Statements,  Facebook  did  not  mention  the 
Cambridge  Analytica  incident,  and  also  did  not  mention  these  facts  in  any  of  its  Form  8-K  or 
Form  6-K  filings.  Instead,  Facebook  made  general  statements  in  their  most  recent  proxy 
statement  and  annual  report  on  Form  10-K  about  potential,  not  actual,  user  privacy  and  data 
security  risks,  and  certified  that  the  Company’s  internal  controls  were  adequate  and  complied 
with  applicable  laws  (which  necessarily  include  the  FTC  Consent  Order). 

315.  In  addition,  the  financial  statements  and  information  in  Facebook’s  public  filings 
with  the  SEC,  including  in  the  2018  Proxy  Statement,  were  materially  false  and  misleading 
because  Facebook’s  revenue  and  other  financial  metrics  were  overstated  due  to  Defendants’ 
omissions  of  material  information  and  failure  to  sufficiently  and/or  accurately  account  for 
stock-based  compensation  expense,  amounts  that  were  significant  and  material  to 
understanding  Facebook’s  true  financial  condition. 

316.  In  addition  to  the  $22  billion  purchase  price,  the  WhatsApp  merger  agreement 
provided  for  an  additional  $3  billion  in  restricted  stock  units  (“RSUs”)  to  be  granted  to 
WhatsApp ’s  founders  and  employees,  including  defendant  Koum,  that  would  vest  over  four 
years  subsequent  to  closing.  The  Class  A  common  stock  and  RSUs  issued  to  WhatsApp 
shareholders  and  employees  upon  closing  represented  approximately  7.9%  of  Facebook  shares 
then  outstanding. 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

90 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


4:18-cv-01792-HSG  Document  124-2  Filed  08/01/19  Page  97  of  143 


317.  Defendant  Koum  was  granted  approximately  24.9  million  RSUs  in  connection 
with  the  merger  agreement,  including  approximately  7  million  unvested  shares  that  were 
granted  to  Koum  as  an  “inducement  award”  that  remained  unvested  as  of  March  31, 2018. 

318.  The  unvested  RSUs  that  were  granted  to  Koum  were  set  to  vest  incrementally 
until  late  2018,  with  1.9  million  shares  to  vest  on  May  15,  2018  and  in  August  2018,  plus  a 
final  tranche  of  2. 1  million  shares  that  would  be  issued  in  November  201 8,  and  were  contingent 
on  him  still  being  employed  through  those  dates. 

319.  According  to  Facebook’s  Form  8-K  dated  April  30,  2018,  defendant  Koum 
informed  the  Board  in  connection  with  his  resignation  as  CEO  of  WhatsApp  that  he  would  not 
stand  for  re-election  to  the  Board  at  the  2018  Annual  Meeting. 

320.  Accordingly,  at  the  time  of  his  resignation  in  April  2018,  defendant  Koum  would 
have  forfeit  5.8  million  shares,  worth  approximately  $997.5  million  as  of  the  date  of  the 
announcement.  However,  the  “inducement  award”  was  “subject  to  acceleration  if  [Koum’s] 
employment  is  terminated  without  ‘cause’  or  if  the  [he]  resigns  for  ‘good  reason’.” 

321.  According  to  Facebook’s  Form  10-Q  for  the  quarterly  period  ending  March  31, 
2018,  as  of  that  date,  Facebook  had  $10.82  billion  of  unrecognized  share-based  compensation 
expense,  substantially  all  of  which  was  related  to  RSUs.  Included  in  this  amount  were  7 
million  unvested  shares  that  had  been  granted  to  defendant  Koum  as  the  “inducement  award”  in 
connection  with  the  WhatsApp  acquisition  in  2014.  The  “inducement  award”  was  subject  to 
acceleration  pursuant  to  the  terms  of  Koum’s  employment  agreement. 

322.  During  the  relevant  period  of  conduct  alleged  to  violate  the  Corporations  Code, 
Defendants  knew  that  the  material  facts  and  information  described  above  were  not  publicly 
disclosed  and  that  Facebook’s  minority  shareholders  and  the  public  had  no  way  of  knowing 
that  Facebook’s  financial  statements  and  public  filings  were  materially  false  and  misleading 
and,  as  a  result,  shares  of  Facebook’s  Class  A  common  stock  were  trading  at  artificially 
inflated  prices.  While  these  and  other  material  facts  were  concealed  from  Facebook 
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shareholders  and  the  public,  the  Insider  Selling  Defendants  sold  or  otherwise  disposed  of  their 
shares  of  Facebook  common  stock,  thereby  violating  section  25402  of  the  Corporations  Code. 

323.  According  to  Facebook’s  2018  Proxy  Statement  filed  with  the  SEC  on  April  13, 
2018  (the  “2018  Proxy  Statement”),  defendant  Koum  held  approximately  14.2  million  shares  of 

Facebook  Class  A  common  stock.  Beginning  in  2017,  at  the  same  time  when  Facebook  was 

/ 

repurchasing  shares  of  its  Class  A  common  stock  in  the  open  market,  defendant  Koum  sold 
more  than  twice  that  amount,  or  approximately  34.2  million  shares  of  his  personally  held 
Facebook  stock,  at  an  average  price  of  $158.52  per  share,  as  set  forth  in  the  chart  below: 
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324.  According  to  the  2018  Proxy  Statement,  defendant  Sandberg  held  approximately 
3.5  million  shares  of  Facebook  stock,  including  1 .5  million  shares  of  Class  A  common  stock 
held  indirectly  through  a  trust,  and  an  additional  2  million  shares  of  Facebook  Class  B  stock. 
Beginning  in  2017,  at  the  same  time  when  Facebook  was  repurchasing  shares  of  its  Class  A 
common  stock  in  the  open  market,  defendant  Sandberg  sold  almost  twice  that  amount,  or 
nearly  7  million  shares  of  her  personally  held  Facebook  stock,  at  an  average  price  of  $155.78 
per  share,  as  set  forth  in  the  chart  below: 
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6/18/2017 

19,722 

$153.04 

1,904,912 

7/14/2017 

39,104 

$159.97 

1,940,748 

7/30/2017 

590,000 

n/a 

1,350,748 

8/14/2017 

6,800 

$170.75 

1,356,978 

8/14/2017 

6,800 

$170.75 

1,356,978 

10/14/2017 

39,105 

$173.74 

1,413,468 

11/14/2017 

6,799 

$178.07 

1,440,352 

11/14/2017 

22,539 

$178.07 

1,434,122 

2/13/2018 

12,525 

$177.14 

1,463,727 

2/13/2018 

6,300 

$176.54 

1,476,252 

2/13/2018 

12,875 

$179.32 

1,440,352 

2/13/2018 

10,500 

$178.32 

1,453,227 

2/13/2018 

10,900 

$174.97 

1,482,552 

2/13/2018 

1,900 

$173.46 

1,493,452 

2/13/2018 

12,525 

$177.14 

1,463,727 

2/13/2018 

6,300 

$176.54 

1,476,252 

2/13/2018 

12,875 

$179.32 

1,440,352 

2/13/2018 

10,500 

$178.32 

1,453,227 

2/13/2018 

10,900 

$174.97 

1,482,552 

2/13/2018 

1,900 

$173.46 

1,493,452 

2/14/2018 

8,185 

$179.52 

1,472,803 

2/14/2018 

6,461 

$179.52 

1,464,480 

2/14/2018 

233 

n/a 

n/a 

2/14/2018 

17,038 

$179.52 

1,457,911 

2/14/2018 

233 

n/a 

n/a 

2/14/2018 

17,038 

$179.52 

1,457,911 

3/1/2018 

11,080 

$174.51 

1,498,523 
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3/1/2018 

22,236 

$175.49 

1,476,287 

3/1/2018 

18,200 

$173.62 

1,509,603 

3/1/2018 

3,484 

$176.48 

1,472,803 

3/14/2018 

26,134 

$183.51 

1,472,803 

3/14/2018 

28,866 

$182.79 

1,498,937 

4/1/2018 

2,400 

$158.54 

1,472,803 

4/1/2018 

16,870 

$154.95 

1,510,933 

4/1/2018 

3,500 

$157.65 

1,475,203 

4/1/2018 

20,620 

$155.60 

1,490,313 

4/1/2018 

11,610 

$156.67 

1,478,703 

4/17/2018 

40,261 

$166.66 

1,487,542 

4/17/2018 

14,739 

$167.32 

1,472,803 

5/29/2018 

37,308 

$187.72 

1,505,021 

5/29/2018 

5,200 

$186.80 

1,542,329 

5/29/2018 

12,492 

$185.88 

1,547,529 

8/28/2018 

34,371 

$175.44 

1,557,868 

8/28/2018 

20,629 

$176.04 

1,537,239 

10/31/2018 

334,300 

n/a 

1,202,939 

11/13/2018 

23,034 

$143.09 

1,223,727 

11/13/2018 

3,934 

$145.06 

1,202,939 

11/13/2018 

16,854 

$144.11 

1,206,873 

11/13/2018 

11,178 

$142.08 

1,246,761 

11/14/2018 

8,186 

$144.22 

1,235,157 

11/14/2018 

6,461 

$144.22 

1,226,834 

11/14/2018 

17,039 

$144.22 

1,220,265 

3/12/2019 

28,451 

$172.92 

1,298,676 

3/12/2019 

26,549 

$173.58 

1,272,127 

3/24/2019 

10,471 

$166.09 

1,272,127 

3/24/2019 

18,398 

$164.46 

1,282,598 

3/24/2019 

6,372 

$162.72 

1,320,755 

3/24/2019 

19,759 

$163.83 

1,300,996 

4/3/2019 

24,694 

$177.10 

1,278,190 

4/3/2019 

24,243 

$176.05 

1,302,884 

4/3/2019 

6,063 

$177.71 

1,272,127 

ctI-O  I 

Average  During  Period: 

$155.78 

1,882,506 

325.  According  to  Facebook’s  Form  10-Q  filed  with  the  SEC  on  P 
defendant  Zuckerberg  indirectly  held  approximately  1 1 .92  million  Class  A 
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series  of  funds.  On  July  25,  2018,  while  Facebook’s  stock  price  was  trading  at  around  its  all- 
time  high,  Zuckerberg  sold  240,000  shares  of  Facebook  Class  A  common  stock  at  an  average 
price  of  $216.71  per  share,  near  its  all-time  high  of  approximately  $223  per  share  earlier  that 
month,  for  total  proceeds  of  just  over  $52  million. 

326.  Defendant  Zuckerberg’s  stock  sales  have  dramatically  risen  in  the  last  five  years, 
as  demonstrated  by  the  chart  below.  In  the  last  5  years,  Zuckerberg  has  sold  41 ,734,748  shares 
of  his  Facebook  stock,  36%  of  which  (1 5,1 36,652  shares)  were  sold  in  the  last  12  months: 


327.  The  Insider  Selling  Defendants’  sales  of  their  Facebook  shares  described  above 
were  unusual  in  timing  and/or  amount,  particularly  in  that  they  occurred  at  the  same  time  as 
Facebook  was  repurchasing  shares  of  its  common  stock  in  the  open  market. 

328.  Throughout  the  relevant  period  in  2017,  2018  and  2019  when  Facebook  was 
repurchasing  its  shares,  the  Company’s  stock  price  was  trading  at  prices  that  were  artificially 
inflated  by  the  materially  false  and  misleading  statements  and  omissions  described  above,  as 
shown  in  the  following  charts: 
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FACEBOOK,  INC.  STOCK  PRICE  CHART 
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IX.  DEFENDANTS  ARE  LIABLE  FOR  DAMAGES  TO  FACEBOOK 

329.  Defendants’  misconduct  and  violations  of  law  alleged  herein,  including  violations 

of  the  California  Corporations  Code,  has  caused  Facebook  to  suffer  damages  and  other  harm, 
including  to  its  reputation,  and  Facebook  will  undoubtedly  continue  to  suffer  damages  and 
harm  as  a  result  of  these  wrongful  acts  for  the  foreseeable  future. 

330.  Facebook’s  users  and  current  and  potential  investors  in  the  Company’s  securities 
consider  Facebook’s  ability  to  protect  its  users’  personal  information,  and  to  maintain  adequate 
internal  controls  and  reporting  procedures  designed  to  ensure  that  violations  of  Facebook’s 
policies  are  timely  discovered,  properly  addressed  and  enforced  by  the  Company,  material 
infonnation.  Defendants’  failures  to  protect  user  data  and  to  maintain  and  enforce  policies 
respecting  same  has  harmed  Facebook,  as  users  are  less  likely  to  visit  websites  that  knowingly 
permit  or  encourage  unscrupulous  behavior,  and  investors  are  less  likely  to  invest  in  companies 
that  lack  internal  controls  and  fail  to  timely  disclose  material  information.  Thus,  Facebook’s 
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ability  to  attract  customers  and  investors  is  now  impaired  due  to  Defendants’  misconduct  and 
violations  of  law  alleged  herein. 

33 1 .  Further,  as  a  direct  and  proximate  result  of  Defendants’  misconduct  and 
violations  of  law  alleged  herein,  Facebook  has  expended  and  will  continue  to  expend 
significant  additional  money,  including  costs  incurred  in  repurchasing  shares  of  Facebook  stock 
at  prices  that  were  artificially  inflated  by  Defendants’  false  and  misleading  statements;  and 
costs  incurred  in  connection  with  substantial  compensation  and  benefits  paid  in  cash  and  in 
shares  of  Facebook  stock,  to  Defendants  who  are  responsible  for  the  violations  of  law  alleged 
herein. 

X.  DEMAND  ON  FACEBOOK’S  BOARD  WAS  FUTILE  AND  THUS,  EXCUSED 

332.  Plaintiff  did  not  make  a  demand  on  Facebook’s  Board  of  Directors  to  institute 

this  action  against  Defendants  because,  for  the  reasons  detailed  above  and  as  set  forth  further 
below,  any  such  demand  would  have  been  futile. 

333.  The  facts  detailed  in  this  Complaint  demonstrate  that  the  Defendants 
affirmatively  adopted,  implemented,  and  condoned  a  business  strategy  based  on  deliberate  and 
widespread  violations  of  applicable  law,  which  is  not  a  legally  protected  business  decision  and 
can  in  no  way  be  considered  a  valid  exercise  of  business  judgment,  and/or  consciously 
disregarded  numerous  red  flags  of  misconduct  throughout  the  relevant  period,  subjecting  them 
to  a  substantial  likelihood  of  liability  as  to  Plaintiffs’  claims  against  them  in  this  action. 
Moreover,  defendant  Zuckerberg  dominates  and  controls  the  Board,  and  a  majority  of  the 
directors  are  beholden  to  Zuckerberg  and  lack  independence  from  him.  For  all  of  these 
reasons,  a  demand  on  the  Board  would  have  been  futile. 

334.  At  the  time  this  action  was  filed,  Facebook’s  Board  consisted  of  eight  members, 
including  defendants  Zuckerberg,  Sandberg,  Andreessen,  Thiel,  Desmond-Hellman,  Chenault, 
and  Zients  and  Facebook  director  Peggy  Alford. 
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A.  Demand  Was  Futile  Because  a  Majority  of  Facebook’s  Board  Faces  a 

Substantial  Likelihood  of  Liability 

335.  Plaintiffs  did  not  make  a  demand  on  the  Facebook  Board  prior  to  instituting  this 
action  because  a  majority  of  the  Board  members  face  a  substantial  likelihood  of  liability  for  the 
claims  alleged  against  them  in  this  Complaint. 

336.  The  Board  was  well  aware  of  how  the  Company  was  monetizing  user  data.  The 
Board  approved  acquisitions  that  expanded  the  functionality  and  reach  of  the  Facebook 
platform  and  enables  it  to  obtain  additional  user  data.  Facebook  executives  apprised  the  Board 
at  least  quarterly  regarding  Facebook’s  “advertising  operations  and  revenues.”  In  addition, 
certain  directors’  affiliated  companies,  including  WhatsApp  (defendant  Koum),  which  became 
a  subsidiary  of  Facebook  following  its  acquisition  by  the  Company  in  2014,  and  Netflix 
(defendant  Hastings)  entered  into  partnerships  with  Facebook  that  included  the  sharing  of 
Facebook  information. 

337.  The  Board  received  many  “red  flag”  warnings  both  before  and  during  the 
relevant  period  that  Facebook’s  privacy  policies  did  not  comply  with  applicable  laws,  and 
moreover,  knew  or  should  have  known  that  the  same  practices  which  violated  the  law  and  user 
trust  was  the  Company’s  primary  source  of  revenue. 

338.  During  a  May  27,  2015  presentation  to  the  IRS,  a  Facebook  representative 
indicated  that  “[Facebook]  built  ‘forecasts,’  from  internal  and  external  data,  projecting 
[Facebook] ’s  [REDACTED]  on  a  country-by-country  basis,  so  that  Facebook  could  look  at  the 
forecasts,  ‘U.S.  versus  international.’”  The  representative  stated  that  she  has  seen  both  year¬ 
long  and  three  year  forecasts,  and  the  IRS  subsequently  asked  Facebook  to  provide  all 
Documents  constituting,  reflecting  or  referring  to  any  such  “forecasts”  of  growth  of  [redacted], 
created,  obtained  or  circulated  from  2008  until  2012.  If,  as  the  IRS  disclosures  suggest, 
Facebook  forecasted  growth  based  on  national  and  international  rights  to  exploit  Facebook’s 
“platform  technology,”  there  can  be  no  doubt  that  the  Board  knew  of  such  exploitation  of  user 
data,  and  that  it  has  been  a  core  aspect  of  Facebook’s  business  since  well  before  the  Company’s 
initial  public  offering  in  2012. 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

100 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


ase  4:18-cv-01792-HSG  Document  124-2  Filed  08/01/19  Page  107  of  143 


339.  In  the  June  8, 2016  summons,  the  IRS  noted  that  a  former  Facebook  executive 
who  was  examined  under  oath  by  the  IRS  on  May  17,  2016,  “made  quarterly  presentations  to 
[Facebook] ’s  Board  of  Directors  regarding  user  growth,  projected  and  actual;  (b)  other 
executives  of  [Facebook]  also  made  quarterly  presentations  to  [Facebook] ’s  Board  of  Directors 
on  topics  or  areas  covered  by  the  divisions  they  supervised;  and  (c)  quarterly  financials  were 
presented  to  the  Board  of  Directors  as  part  of  the  quarterly  board  meetings.” 

340.  Given  the  Board’s  awareness  and  deliberate  concealment  of  the  extent  to  which 
Facebook’ s  business  model  and  revenue  depends  upon  its  targeted  advertisements,  which 

requires  the  Company  to  collect,  store,  and  share  massive  amounts  of  user  data,  and 

/ 

Facebook’ s  failure  to  disclose  or  notify  users  of  these  practices,  it  is  clear  the  Board  either 
deliberately  or  recklessly  permitted  the  Company  to  pursue  profit  at  the  expense  of  complying 
with  the  law. 

341 .  Defendants  directed,  authorized,  and  oversaw  the  misconduct  alleged  herein,  and 
they  regularly  monitored  Facebook’ s  user  and  revenue  growth. 

342..  Defendant  Zuckerberg  was  personally  involved  in  developing  Facebook’s 
platform  and  was  responsible  for  its  implementation,  to  a  degree  that  reflects  far  more  than  his 
supervisory  role  of  the  Company  as  CEO.  In  that  role,  Zuckerberg  specifically  instructed 
Facebook  employees  to  prepare  for  and  circumvent  the  blocks  that  he  anticipated  other 
websites  would  implement. 

343.  Demand  is,  therefore,  futile  (and  excused). 

344.  Defendants  Andreessen  and  Desmond-Hellmann  are  members  of  Facebook’s 
Audit  Committee,  which  is  responsible  for  overseeing  the  Company’s  legal  and  regulatory  risk 
exposure.  Until  May  2019,  defendant  Bowles  was  the  Chairman  of  the  Audit  Committee,  and  a 
financial  expert,  as  defined  under  the  SEC  rule. 

345.  The  members  of  Facebook’s  Audit  Committee  failed  to  meet  their  obligations  as 
provided  in  the  Audit  Committee  Charter,  in  addition  to  their  duties  imposed  by  law,  because 
despite  the  numerous  regulatory  fines,  investigations,  and  reports  finding  fundamental  failings 
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in  the  Company’s  internal  controls,  they  did  not  cause  Facebook  to  remediate  those  control 
deficiencies.  The  Audit  Committee’s  deliberate  failure  of  oversight  constituted  breaches  of 
their  fiduciary  duties  to  Facebook  and  has  resulted  in  significant  harm  to  the  Company. 

346.  Further,  the  Audit  Committee  members  were  charged  with  assisting  the  Board  in 
overseeing  the  integrity  of  the  Company’s  financial  statements  and  the  adequacy  and  reliability 
of  disclosures  to  its  stockholders,  including  the  Company’s  internal  controls. 

347.  The  Audit  Committee  was  directly  responsible  for  approving  the  Company’s 

materially  false  and  misleading  SEC  filings  including  the  2017  and  2018  Proxy  Statements. 

B.  Demand  Was  Also  Futile  Because  Facebook  and  Its  Board  Are  Dominated 

and  Controlled  By  Zuckerberg 

348.  Demand  was  also  futile,  and  therefore  excused,  because  defendant  Zuckerberg 
dominates  and  controls  the  entire  Board  by  virtue  of  his  controlling  voting  power,  and  because 
a  majority  of  the  directors  are  beholden  to  him,  and  lack  independence  from  him,  as  explained 
further  below. 

349.  There  is  no  question  that  defendant  Zuckerberg  controls  the  Board  and  the  entire 
Company  in  his  role  as  CEO  of  Facebook,  which  he  founded.  Facebook’s  status  as  a 
“controlled”  company  is  inherent  in  its  corporate  governance  and  capital  (dual-class)  structure, 
and  the  role  that  Zuckerberg  has  played  in  recruiting  and  retaining  the  current  directors  cannot 
be  understated.  It  is  Zuckerberg  alone  who  has  the  power  to  elect  (and  remove)  any  director 
from  Facebook’s  Board;  by  virtue  of  his  share  ownership,  he  controls  a  majority  of  Facebook’s 
outstanding  voting  power,  or  53.3  percent  of  the  total  voting  power,  according  to  the 
Company’s  2018  Proxy  Statement.  Zuckerberg’ s  control  of  Facebook  is  like  a  dictatorship, 
and  he  directs  and  is  responsible  for  the  activities  of  Facebook’s  employees. 

350.  According  to  Facebook’s  2017  Proxy  Statement: 

Because  Mr.  Zuckerberg  controls  a  majority  of  our  outstanding  voting  power,  we 
are  a  “controlled  company ”  under  the  corporate  governance  rules  of  the  NASDAQ 
Stock  Market  LLC  (NASDAQ).  Therefore,  we  are  not  required  to  have  a  majority 
of  our  board  of  directors  be  independent,  nor  are  we  required  to  have  a 
compensation  committee  or  an  independent  nominating  function.  In  light  of  our 
status  as  a  controlled  company,  our  board  of  directors  has  determined  not  to  have 
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an  independent  nominating  function  and  to  have  the  full  board  of  directors  be 
directly  responsible  for  nominating  members  of  our  board. 

351.  Defendant  Zuckerberg  directs  and  controls  the  Company’s  business  and  is 
personally  responsible  for  the  damage  caused  to  Facebook  as  a  result  of  the  illegal  business 
practices  and  data  sharing  that  led  to  the  Cambridge  Analytica  scandal.  Accordingly, 
defendant  Zuckerberg  lacks  the  requisite  “disinterestedness”  to  consider  a  demand. 

352.  Former  Facebook  employee  Parakilas  confirmed  that  defendant  Zuckerberg  has 
always  been  responsible  for  Facebook’ s  policies,  noting  that  shortly  after  he  arrived  at  the 
company’s  Silicon  Valley  headquarters  in  2011,  Parakilas  was  told  that  any  decision  to  ban  an 
app  required  the  personal  approval  of  defendant  Zuckerberg,  although  the  policy  was  later 
relaxed. 

353.  Facebook’s  website  states  that  “Mark  [Zuckerberg]  is  responsible  for  setting  the 
overall  direction  and  product  strategy  for  the  company.  He  leads  the  design  of  Facebook’s 
service  and  development  of  its  core  technology  and  infrastructure.”  Defendant  Zuckerberg  also 
is  responsible  for  Facebook’s  policies,  according  to  defendant  Sandberg.  In  a  May  30, 2018 
interview  with  Recode  Media,  Sandberg  stated,  “Mark  has  said  very  clearly  on  Cambridge 
Analytica  that  he  designed  the  platform  and  he  designed  the  policies,  and  he  holds  himself 
responsible.”  Defendant  Zuckerberg  directs  and  controls  the  Company’s  business  and  is 
personally  liable  for  the  wrongdoing  and  damage  caused  to  Facebook  as  alleged  herein. 
Accordingly,  defendant  Zuckerberg  lacks  the  requisite  “disinterestedness”  to  consider  a 
demand. 

354.  In  an  interview  with  Recode  Media  on  May  30,  2018,  defendant  Sandberg 
acknowledged  the  entrenchment  of  defendant  Zuckerberg  and  that  he  (and  she)  will  make 
decisions  notwithstanding  any  criticism.  “You  know,  in  terms  of  the  business,  we  don’t  make 
decisions  for  the  short  run.  We  don’t  have  to  and  we  shouldn’t.  I  don’t  think  any  company 
should  have  to.  But  we  have  founder  control  and  protections  in  place,  and  we’re  very  clear  that 
we’re  gonna  make  the  investments  we  need  to  make.” 
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355.  On  June  26,  2018,  a  group  of  six  of  Facebook’s  largest  shareholders  publicly 
asked  to  remove  Zuckerberg  from  his  chairman  position  and  to  replace  him  with  an 
independent  executive.  The  shareholders  also  wanted  to  get  rid  of  Facebook’s  dual-class  share 
structure,  which  they  believe  hands  over  too  much  power  to  Zuckerberg  and  his  team  of 
executives.  Facebook  unsurprisingly  objected,  “We  believe  that  our  capital  structure  is  in  the 
best  interests  of  our  stockholders  and  that  our  current  corporate  governance  structure  is  sound 
and  effective.”  This  has  been  a  common  rhetoric  from  Zuckerberg  and  Facebook,  as  he  has 
long  faced  criticism  over  the  dual-class  share  structure,  but  he  has  ultimately  refused  to  even 
consider  making  any  changes.  Even  independent  investors  have  called  for  Zuckerberg  to  step 
down  as  chairman  and  for  Facebook  to  dissolve  its  dual-class  stock  structure.  Neither  of  these 
has  happened.  Zuckerberg  habitually  ignores  the  protests,  objections,  and  suggestions  of  both 
shareholders  and  independent  investors,  and  continues  to  benefit  financially  in  the  form  of 
billions  of  dollars  due  to  Facebook’s  top-heavy  corporate  governance  structure.  Clearly, 
Zuckerberg’ s  decision-making  rationale  does  not  take  into  consideration  the  opinions  of 
shareholders,  and  he  prioritizes  his  own  power  and  control  instead  of  the  long-term  interests  of 
the  Company. 

356.  Defendant  Zuckerberg  has  always  dominated  and  controlled  Facebook  and  its 
Board,  and  his  aspirations  were  even  larger  all  the  way  back  in  2005.  Former  Facebook 
employee  Kate  Losse  (“Losse”),  a  speechwriter  for  Zuckerberg  until  2005,  recalls  that 
Zuckerberg  would  end  weekly  Friday  all-hands  meeting  by  raising  his  fist  with  a  slight  smile 
and  saying,  “Domination!” 

357.  Losse  confirmed  that  Zuckerberg  created  an  atmosphere  at  Facebook  that 
discouraged  questioning  power  and  standing  up  to  management.  Losse  stated,  “But  the 
question  I  was  afraid  to  ask  him  was  this:  If  we  were  to  achieve  our  goal,  why  should  the  world 
trust  Facebook  or  Zuckerberg  to  shape  and  manage  this  new  global  meta-society?  Could 
Zuckerberg,  who  wields  considerable  power  over  Facebook’s  share  structure,  develop  the  self- 
awareness  and  responsibility  to  manage  it?  If  my  co-workers  were  asking  themselves  these 
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same  questions,  I  didn’t  see  it  being  discussed  on  our  internal  forum  pages  or  in  conversations 
around  the  office.” 

358.  Losse  noted  that  most  employees  were  afraid  of  losing  their  lucrative  jobs  and 
that  “internal  conversations  stayed  focused  on  technical  and  growth  questions;  questions  that 
can  be  answered  with  metrics  —  how  fast  are  we  growing  and  what  technical  roadblocks  can 
we  remove  —  rather  than  introspection.”  While  Losse  recalls  this  being  the  atmosphere  back 
in  2005,  it  seems  to  have  manifested  into  Zuckerberg’s  push  for  the  growth-at-all-costs  model 
introduced  in  2008.  Zuckerberg’s  style  of  responding  to  questioning  from  members  of  the 
U.S.  Congress  and  the  U.K.  Parliament  reflects  this  culture:  rather  than  actually  speaking  about 
possible  internal  improvement,  Zuckerberg  deflected  questions  and  avoided  answering  them 
directly  by  purposely  focusing  on  explaining  Facebook  in  technical  terms. 

359.  The  results  of  the  2019  annual  meeting  of  Facebook’s  shareholders  confirm  that 

defendant  Zuckerberg  continues  to  control  the  Board. 

C.  Demand  Was  Also  Futile  Because  a  Majority  of  The  Directors  Lack 

Independence  From  and  Are  Beholden  to  Zuckerberg 

360.  All  of  the  directors  on  Facebook’s  Board  lack  independence  from  defendant 
Zuckerberg,  for  these  and  other  reasons  explained  below.  Because  he  dominates  and  controls 
the  entire  Board,  demand  was  futile  as  to  defendant  Zuckerberg  and  is  excused  as  to  the  entire 
Board. 

\ 

1.  Defendant  Thiel  Lacks  Independence 

361 .  Defendant  Thiel  was  one  of  the  early  investors  in  Facebook  and  is  its  longest- 
standing  Board  member  besides  Zuckerberg.  Thiel  co-founded  PayPal,  Inc.,  and  has  been  a 
Partner  of  the  Founders  Fund,  a  venture  capital  firm  that  strives  to  keep  founders  in  control  of 
the  companies  they  have  created,  since  2005.  Thiel  also  co-founded  Palantir  in  2003. 

362.  Defendant  Thiel  has  been  instrumental  to  Facebook’s  business  strategy  over  the 
years.  He  has  been  known  to  personally  engage  in  secretive  politically-motivated  litigation 
tactics,  most  notably  with  regard  to  Gawker,  a  gossip  website  that  owned  Valleywag,  a  blog 
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specifically  concerning  Silicon  Valley  gossip.  Angered  by  a  2007  post  on  Valleywag 
headlined  “Peter  Thiel  Is  Totally  Gay,  People”  and  other  stories  published  on  Gawker’ s 
website,  he  secretly  financed  a  lawsuit  filed  by  Terry  Bollea  (the  real  name  of  the  wrestler  Hulk 
Hogan)  against  Gawker  for  posting  an  excerpt  from  a  sex  tape  showing  Mr.  Hogan  with  a 
friend’s  wife.  After  Hogan  won  a  $140  million  judgment  against  Gawker,  the  site  went 
bankrupt.  Gawker  founder  Nick  Denton  described  Thiel  to  Vanity  Fair  as  “interesting  —  and 
scary.” 

363 .  The  New  York  Times  reported  on  Thiel’s  connections  to  Palantir  and  Cambridge 
Analytica  in  an  article  published  on  January  11,  2017.  According  to  The  Times,  Thiel  was  “a 
member  of  the  Trump  transition  team”  and  had  “dressed  as  Hulk  Hogan  for  the  ‘Villains  and 
Heroes’  annual  costume  party  last  month,  hosted  on  Long  Island  by  the  Mercer  family,  who 
were  big  Trump  donors.”  Thiel,  who  was  reportedly  advising  the  Trump  transition  team  on 
“science,”  had  recently  organized  a  meeting  with  tech  executives,  including  Palantir’ s  CEO, 
Alex  Karp,  and  other  executives  who  were  described  as  “anti-Trump”  but  had  “sort  of  changed 
their  minds.” 

364.  When  asked  by  the  reporter  if  he  was  concerned  about  conflicts  of  interest  in 
relation  to  Trump  and  the  tech  meeting,  Thiel  said:  “I  don’t  want  to  dismiss  ethical  concerns 
here,  but  I  worry  that  ‘conflict  of  interest’  gets  overly  weaponized  in  our  politics.  I  think  in 
many  cases,  when  there’s  a  conflict  of  interest,  it’s  an  indication  that  someone  understands 
something  way  better  than  if  there’s  no  conflict  of  interest.  If  there’s  no  conflict  of  interest,  it’s 
often  because  you’re  just  not  interested.”  Thiel  also  reportedly  said  in  response  to  a  comment 
by  the  reporter  that  Barack  Obama  had  avoided  “any  ethical  shadiness”  during  his  eight- year 
term  as  president,  “But  there’s  a  point  where  no  corruption  can  be  a  bad  thing.  It  can  mean  that 
things  are  too  boring.” 

365.  Defendant  Thiel’s  other  comments  during  the  interview  are  telling  as  to  his 
knowledge  of  Facebook’s  illicit  business  practices  and  are  similarly  unsettling  as  to  his 
membership  on  Facebook’s  Board.  For  instance,  the  Times  reporter  commented  that  “Mr. 
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Thiel  and  Mr.  Trump  are  strange  bedfellows,  given  that  much  of  Mr.  Thiel’s  billions  came 
from  being  one  of  the  original  investors  in  Facebook  and  Mr.  Trump  recently  said  it’s  better  to 
send  important  messages  by  courier.”  In  response,  Thiel  stated,  “Well,  one  does  have  to  be 
very  careful  with  what  one  says  in  an  email.” 

366.  In  the  interview,  Thiel  acknowledged  the  reports  of  Russian  hacking,  stating, 
“There’s  a  strong  circumstantial  case  that  Russia  did  this  thing.”  When  asked  if  he  worried 
about  the  relationship  between  Vladimir  V.  Putin  and  then-President  elect  Trump,  Thiel 
responded,  “But  should  Russia  be  allied  with  the  West  or  with  China?”  “There  are  these  really 
bad  dictators  in  the  Middle  East,  and  we  got  rid  of  them  and  in  many  cases  there’s  even  worse 
chaos.”  Thiel  also  stated,  “It’s  the  people  behind  the  red-eyed  robots  that  you  need  to  be  scared 
of.”  When  asked  about  the  “incestuous  amplification  of  the  Facebook  news  feed,”  Thiel 
cryptically  responded,  “There’s  nobody  you  know  who  knows  anybody.  There’s  nobody  you 
know  who  knows  anybody  who  knows  anybody,  ad  infinitum.” 

367.  The  Times  reporter  pointed  out  that  Thiel  is  a  “social-media  visionary”  yet  he 
“rarely  updates  his  Facebook  page  and  doesn’t  tweet,”  which  Thiel  reportedly  said  is  “because 
you  always  want  to  get  things  exactly  right”  and  “if  you  start  doing  it,  you  have  to  do  it  a  lot.” 
According  to  the  reporter,  Thiel  also  “wondered  if  his  most  famous  investment,  Facebook, 
contributes  to  herd  mentality.” 

368.  In  his  testimony  to  the  DCMS,  Wylie  discussed  a  connection  between  Cambridge 
Analytica  and  Palantir,  a  company  that  was  co-founded  in  2003  by  defendant  Thiel.  Palantir  is 
known  for  providing  government  agencies  and  organizations  with  analytics,  security  and  other 
data  management  solutions.  According  to  Wylie,  Palantir  staff  helped  Cambridge  Analytica 
build  models  based  on  the  Facebook  data.  “That  was  not  an  official  contract  between  Palantir 
and  Cambridge  Analytica  but  there  were  Palantir  staff  who  would  come  into  the  office  and 
work  on  the  data,”  Wylie  stated.  “And  we  would  go  and  meet  with  Palantir  staff  at  Palantir. 

So,  just  to  clarify,  Palantir  didn’t  officially  contract  with  Cambridge  Analytica.  But  there  were 
Palantir  staff  who  helped  build  the  models  that  we  were  working  on.” 
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369.  Initially  in  response  to  a  request  for  comment  on  Wylie’s  testimony,  TechCrunch 
reported  on  March  27, 2018  that  a  Palantir  spokesperson  had  denied  the  connection  entirely  in 
an  emailed  statement:  “Palantir  has  never  had  a  relationship  with  Cambridge  Analytica  nor 
have  we  ever  worked  on  any  Cambridge  Analytica  data.”  According  to  the  New  York  Times, 
Palantir  subsequently  issued  a  revised  statement:  “We  learned  today  that  an  employee,  in  2013- 
2014,  engaged  in  an  entirely  personal  capacity  with  people  associated  with  Cambridge 
Analytica,”  a  Palantir  representative  said.  “We  are  looking  into  this  and  will  take  the 
appropriate  action.” 

370.  Defendant  Thiel  will  not  institute  any  litigation  against  Zuckerberg  because  he  is 
beholden  to  him.  Thiel  has  greatly  benefited  by  his  relationship  with  Zuckerberg  and  his  seat 
on  the  Facebook  Board.  The  Founders  Fund  gets  “good  deal  flow”  from  this  high  profile 
association,  and  further  demonstrates  that  Thiel  has  a  personal  bias  in  favor  of  keeping 
founders  in  control  of  the  companies  they  created  and  will  not  act  to  remove  Zuckerberg  from 
his  position.  Thiel’s  venture  capital  fund,  The  Founders  Fund,  is  marketed  on  the  principle  that 
company  founders  should  have  long-term  control  of  the  companies  they  create.  In  fact,  the 
Fund’s  website  touts  Facebook  as  a  primary  example  of  that  maxim,  stating  that  “we  have  often 
tried  to  ensure  that  founders  can  continue  to  run  their  businesses  through  voting  control 
mechanisms,  as  Peter  Thiel  did  with  Mark  Zuckerberg  and  Facebook.” 

371 .  In  addition  to  the  past  connections  which  demonstrate  that  defendant  Thiel  lacks 
independence  from  defendant  Zuckerberg,  Thiel  has  a  current  personal  and  financial  interest  in 
remaining  on  Facebook’s  Board.  According  to  the  2018  Proxy  Statement,  the  Facebook  shares 
owned  by  the  Founders  Fund  -  i.e.,  defendants  Thiel  and  Andreesen  -  are  to  be  released  from 

escrow  in  connection  with  Facebook’s  2014  acquisition  of  Oculus  VR,  a  virtual  reality  device 

\ 

maker.  Thiel  stands  to  gain  substantially  from  the  vesting  of  stock  in  connection  therewith. 

372.  The  foregoing  facts  demonstrate  that  defendant  Thiel  is  interested  and  lacks 
independence  due  to  his  close  relationship  with  defendant  Zuckerberg  and  will  not  take  any 
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action  against  Zuckerberg  or  that  will  threaten  his  prestigious  and  lucrative  position  as  a 
Facebook  director.  Demand  was  futile  as  to  defendant  Thiel. 

2.  Defendant  Andreessen  Lacks  Independence 

373.  Defendant  Andreessen  lacks  independence  due  to  his  unusually  close  personal 

and  business  relationships  and  his  “sense  of  owingness”  to  defendant  Zuckerberg,  and  to  other 
interested  directors,  due  to  his  receipt  of  personal  and  financial  benefits  not  shared  with  other 
(minority)  shareholders  of  Facebook,  which  were  approved  by  the  Board  or  that  defendant 
Andreessen  received  due  to  his  position  on  Facebook’s  Board,  or  as  a  result  of  his  close 
personal  and  business  relationships  with  defendant  Zuckerberg  and  other  directors  who 
approved  various  transactions  from  which  Andreessen  personally  benefited. 

374.  Andreessen  received  personal  financial  or  reputational  benefits  from  various 
transactions,  payments  and/or  compensation  that  Facebook’s  entire  Board  approved,  including 
Facebook’s  acquisition  of  Oculus  VR. 

375.  Defendant  Andreessen  is  beholden  to  Facebook’s  Board,  and  especially  to  its 
founder,  CEO,  controlling  director  and  shareholder  with  a  majority  of  voting  rights,  defendant 
Zuckerberg,  due  to  their  unusually  close  business  and  personal  relationships,  and  because 
Andreessen  feels  a  “sense  of  owingness”  for  past  personal  reputational  and  financial  benefits 
that  he  received  as  a  result  of  his  position  on  Facebook’s  Board,  or  transactions  that  Were 
approved  by  Zuckerberg  and/or  the  Board  due  to  the  substantial  personal  and  financial  benefits 
that  he  has  received  and  that  the  Board  has  approved.  The  Founders  Fund  gets  “good  deal 
flow”  from  this  high  profile  association.  Moreover,  according  to  the  2018  Proxy  Statement,  the 
Facebook  shares  owned  by  the  Founders  Fund  -  i.e.,  defendants  Thiel  and  Andreesen  -  are  to 
be  released  from  escrow  in  connection  with  the  Oculus  acquisition.  (2018  Proxy  Statement  at 
39) 

376.  Andreessen  also  lacks  independence  because  he  is  beholden  to  defendant 
Zuckerberg  and  to  Facebook’s  Board  due  to  the  substantial  personal  financial  benefits  he  has 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

109 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


ase  4:18-cv-01792-HSG  Document  124-2  Filed  08/01/19  Page  116  of  143 


received  from  highly  lucrative  deals  between  Andreessen  or  his  venture  capital  firm, 
Andreessen  Horowitz,  have  made  with  Zuckerberg  in  the  past  few  years;  Andreessen  Horowitz 
has  seen  two  of  its  portfolio  companies  purchased  by  Facebook  -  Instagram  and  Oculus  VR  - 
now  Facebook  subsidiaries. 

377.  Andreessen  turned  his  firm’s  $250,000  investment  in  Instagram  into  $78  million 
when  Facebook  closed  its  acquisition  of  Instagram  for  $1  billion.  Andreessen  would  not  have 
even  been  able  to  invest  in  Oculus  VR  without  Zuckerberg.  Andreessen  had  declined  to  invest 
in  the  company  previously,  but  desperately  wanted  to  invest  by  the  fall  of  2013,  according  to  an 
October  2015  Vanity  Fair  article.  When  Oculus  VR’s  CEO  seemed  reluctant  to  allow  the 
investment,  Andreessen  reportedly  had  Zuckerberg  talk  to  the  CEO  about  Andreessen. 
Andreessen  Horowitz  got  the  deal  and  Andreessen  became  one  of  four  board  members  for  the 
fledgling  company.  Not  very  long  after,  Zuckerberg  offered  $2  billion  for  Facebook  to  acquire 
Oculus  VR. 

378.  Andreessen  knows  that  his  firm’s  access  to  the  best  investments  -  its  “deal  flow” 
-  relies  heavily  on  his  relationship  with  Zuckerberg  and  Facebook.  In  a  May  1 8,  201 5  New 
Yorker  article  titled  “Tomorrow’s  Advance  Man,”  Andreessen  reportedly  said  that  “Deal  flow 
is  everything.  If  you’re  in  a  second-tier  firm,  you  never  get  a  chance  at  that  great  company.” 
Andreessen  Horowitz  saw  its  biggest  successes  after  “logo  shopping”  to  add  Facebook  to  the 
firm’s  portfolio  in  2010.  Within  two  years  of  that  investment,  “Andreessen  Horowitz  was  the 
talk  of  the  town.” 

379.  According  to  a  December  8,  2016  article  posted  on  Deal  Breaker,  “Marc 
Andreessen  and  Mark  Zuckerberg  Are  BFFs,  and  Pesky  Board  Negotiations  Can’t  Change 
That,”  Andreessen  was  one  of  Zuckerberg’ s  first  friends  -  and  funders  -  in  the  Valley.  In 
return,  Zuckerberg  gave  him  a  seat  on  the  Board  in  2008,  and  the  two  have  remained  tight 
since.  A  group  of  Facebook  investors  sued  over  concerns  that  Andreessen  and  Zuckerberg’s 
chummy  relationship  created  a  conflict  of  interest  during  a  vote  over  Zuckerberg’s  control  of 
the  Company. 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

110 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


ase  4:18-cv-01792-HSG  Document  124-2  Filed  08/01/19  Page  117  of  143 


380.  The  dispute  arose  when  Zuckerberg’s  wanted  to  sell  of  a  number  of  shares  while 
simultaneously  maintaining  voting  control  of  the  company.  To  do  so  would  require  a  stock 
split  that  would  dilute  other  voting  shares,  potentially  to  the  detriment  of  other  stakeholders. 
The  proposal  was  controversial,  so  the  Board  created  a  special  committee  to  represent 
shareholders  on  the  matter,  composed  of  Susan  Desmond-Hellmann,  Erskine  Bowles  and,  of 
course,  Zuckerberg  close  friend  Andreessen.  While  on  the  committee,  Andreessen  slipped 
Zuckerberg  information  about  their  progress  and  concerns,  helping  Zuckerberg  negotiate 
against  them,  according  to  court  documents. 

t 

381.  When  the  time  came  for  the  committee  to  ask  Zuckerberg  questions  on  a 
conference  call,  Andreessen  warned  the  Facebook  founder  about  what  he  would  be  asked 
before  directors  posed  the  questions.  While  the  committee  grilled  Zuckerberg  about  why  he 
wanted  a  special  class  of  stock,  Andreessen  sent  the  CEO  text  messages  to  explain  which  of  his 
arguments  weren’t  working  and  why,  according  to  messages  quoted  in  court  filings.  During 
one  March  4  call,  Andreessen  gave  Zuckerberg  live  updates,  both  negative  (“This  line  of 
argument  is  not  helping.”)  and  positive  (“NOW  WE’RE  COOKING  WITH  GAS”),  according 
to  texts  provided  by  Facebook’s  lawyers  and  cited  in  court  filings.  “Andreessen  even  told 
Zuckerberg  that  he  was  working  to  protect  Zuckerberg’s  personal  interests  through  the  Special 
Committee  process,”  according  to  the  filings.  When  the  two  prevailed  over  defendant  Bowles, 
who  reportedly  had  initially  looked  askance  at  the  whole  deal,  defendant  Andreessen  texted 
defendant  Zuckerberg,  “The  cat’s  in  the  bag  and  the  bag’s  in  the  river.”  “Does  that  mean  the 
cat’s  dead?”  Zuckerberg  replied,  dumbfounded.  Andreessen  answered,  “Mission  accomplished 
[smiley  face]”. 

3.  Defendant  Sandberg  Lacks  Independence 

382.  Defendant  Sandberg  joined  Facebook  in  2008  as  COO  and  took  over  business 

operations.  Sandberg  oversees  sales  management,  business  development,  human  resources, 
marketing,  public  policy,  privacy  and  communications.  Defendant  Sandberg,  in  her  role  as 
COO  since  2008,  is  responsible  for  directing  and  approving  the  illegal  acts  committed  by 
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Facebook  employees.  Moreover,  Sandberg  has  been  at  Facebook  since  its  early  days,  and  has 
overseen  the  Company’s  meteoric  rise,  based  upon  the  illegal  business  practices  she 
implemented  along  with  Zuckerberg  since  the  launch  of  Facebook’ s  platform  in  2008. 

383.  Facebook  was  running  a  $561  million  deficit  and  struggling  through  a  period  of 
stagnant  growth  at  the  time  of  Sandberg’s  hire  in  2008.  Her  job,  in  essence,  was  to  make  the 
company  profitable  and  she  accomplished  this  by  directing  Facebook  toward  advertising  as  its 
main  business.  She  took  on  the  project  of  integrating  ads  into  the  News  Feed  on  both  the 
desktop  and  mobile  versions  of  Facebook.  Since  user  data  and  advertising  operations  go  hand 
in  hand,  Sandberg  has  an  elevated  responsibility  to  protect  user  information,  especially  since 
Facebook  has  incredible  access  to  the  user  data  of  billions  of  customers.  The  data  that 
Facebook  collects  on  users  funnels  directly  toward  targeted  ads. 

384.  Before  she  was  hired  by  defendant  Zuckerberg,  defendant  Sandberg  served  as 
Google’s  vice  president  of  global  online  sales,  where  she  learned  how  to  profit  from  user  data 
through  targeted  advertising.  When  she  was  brought  on  at  Facebook  in  2008,  Sandberg 
advised  Zuckerberg  to  either  make  users  pay  or  to  make  advertisers  pay,  in  regard  to 
Facebook’s  overarching  business  model.  Together  with  the  other  Defendants,  they  decided  that 
advertisers  would  pay.  From  there,  Sandberg  determined  that  brand  advertising  would  become 
Facebook’s  sole  source  of  revenue,  demonstrating  her  close  personal  and  business  relationship 
with  Zuckerberg,  and  her  significant  influence  on  Facebook’s  business  and  decisions  overall. 
One  year  later,  Facebook  generated  a  profit  for  the  first  time. 

385.  In  2009,  Facebook  generated  $225  million  in  revenue  from  ad  sales,  and  the 
following  year,  brand  advertising  skyrocketed  to  $2  billion  in  sales.  This  concept  of 
maximizing  brand  advertising  that  is  attributable  to  Sandberg  is  consistent  with  Facebook’s 
growth-at-all  costs  strategy  introduced  in  2008  and  cemented  her  dedication  and  loyalty  to 
defendant  Zuckerberg. 

386.  Defendant  Sandberg  has  well-established  connections  with  defendant  Zuckerberg 
and  has  a  significant  influence  on  his  decisions.  When  Zuckerberg  was  considering  hiring 
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Sandberg,  the  two  spent  months  speaking  for  several  hours  a  week  to  determine  whether  she 
would  be  a  good  fit  for  the  position.  To  this  day,  Sandberg  and  Zuckerberg  have  twice-weekly 
meetings  to  give  each  other  feedback  and  to  work  through  disagreements,  which  has  been 
going  on  for  a  decade  now.  She  has  been  deemed  Zuckerberg’ s  second-in-command,  giving 
her  significant  control  in  the  direction  that  Facebook  takes. 

387.  Defendant  Sandberg  has  admitted  that  she  is  personally  responsible  for 
Facebook’s  lax  data  privacy  controls.  In  an  interview  with  Bloomberg,  she  stated,  “I  feel 
deeply  personally  responsible,  because  a  lot  of  mistakes  were  made. .  .what  we  didn’t  do  until 
recently  and  what  we  are  doing  now  is  just  take  a  broader  view  looking  to  be  more  restrictive  in 
ways  data  could  be  misused.  We  also  didn’t  build  our  operations  fast  enough  --  and  that’s  on 
me.”  Compounding  this  issue,  Sandberg  promises  policy  changes  on  data  security  but  still 
does  not  seem  to  have  a  grasp  of  the  severity  of  the  issue.  On  April  5, 2018,  she  told  the 
Financial  Times,  “To  this  day,  we  still  don’t  know  what  data  Cambridge  Analytica  has.” 

388.  Recode  Media  interviewed  defendant  Sandberg  and  Mike  Schroepfer, ' 
Facebook’s  Chief  Technology  Officer,  on  May  30,  2018.  When  asked  why  nobody  had  been 
fired,  and  who  should  have  been  fired,  with  regard  to  the  Cambridge  Analytica  scandal, 
Sandberg  stated,  “So,  Mark  has  said  very  clearly  on  Cambridge  Analytica  that  he  designed  the 
platform  and  he  designed  the  policies,  and  he  holds  himself  responsible.  The  controls  in  the 
company  and  this  are  under  me,  I  hold  myself  responsible  for  the  ones  we  didn’t  have.  And 
look,  Schroepffer]  and  I  are  here,  we  run  the  company.”  She  acknowledged  that  the  Company 
had  insufficient  internal  controls,  stating,  “we  always  had  some  controls  in  place  but  I  don’t 
think  they  were  enough.”  She  further  admitted  that  Facebook  had  not  audited  Cambridge 
Analytica  to  ensure  they  had  actually  deleted  the  data.  “Looking  back,  we  definitely  wish  we 
had  put  more  controls  in  place.  We  got  legal  certification  that  Cambridge  Analytica  didn’t 
have  the  data,  we  didn’t  audit  them,”  she  admitted. 

389.  Despite  admitting  she  was  personally  responsible  for  failing  to  establish  adequate 
internal  controls,  defendant  Sandberg  has  continued  to  defend  Facebook’s  advertising  business 
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that  relies  on  the  mass  collection  of  Facebook  users’  data,  saying  that  it  benefits  consumers. 
Sandberg  uses  “consumer  benefit”  as  a  guised  rationale  for  continuing  its  overreaching 
advertising  business,  when  the  de  facto  purpose  is  to  generate  profit.  This  is  not  surprising,  as 
Sandberg  has  demonstrated  a  track  record  of  prioritizing  profitability,  and  she  was  the  direct 
beneficiary  of  Facebook’s  manipulation  of  consumers’  personal  data  in  the  Cambridge 
Analytica  incident. 

390.  Indeed,  defendant  Sandberg’s  compensation  is  based  off  of  Facebook’s 
profitability,  and  specifically  targets  that  are  related  to  increasing  advertising  revenues. 
According  to  Facebook’s  2017  Proxy  Statement,  Sandberg  received  $631,731  for  the  First  Half 
2016  bonus,  which  reflected  her  “overall  leadership  and  execution  on  business  priorities,  her 
contribution  to  growing  revenue,  continued  strong  growth  in  the  number  of  advertisers  on  our 
[Facebook’s]  platform,  and  her  leadership  in  key  policy  matters.”  Sandberg  received  $661,904 
for  the  Second  Half  2016  bonus.  These  bonuses  were  the  highest  among  those  handed  out  to 
Facebook’s  Board  of  Directors,  highlighting  her  influence  in  policy  decisions  and  her 
established  power  as  a  long-standing  member  of  Facebook’s  Board. 

391 .  More  recently,  in  an  interview  with  NBC’s  Today  show,  Sandberg  said  that  users 
who  wanted  to  stop  Facebook  from  making  money  off  their  personal  data  would  have  to  pay 
for  the  privilege.  Today’s  Savannah  Guthrie  asked,  “Could  you  come  up  with  a  tool  that  said, 

‘I  do  not  want  Facebook  to  use  my  personal  profile  data  to  target  me  for  advertising.’?  Could 
you  have  an  opt-out  button  -  ‘Please  don’t  use  my  profile  data  for  advertising’?”  Sandberg 
responded,  “We  have  different  forms  of  opt-out.  We  don’t  have  an  opt-out  at  the  highest  level. 
That  would  be  a  paid  product.”  Clearly,  Sandberg  has  a  personal  financial  interest  in  Facebook 
continuing  to  earn  revenues  based  on  the  personal  information  and  data  it  obtains  and  generates 
about  Facebook’s  users  and  non-users  and  will  not  act  to  change  its  business  model.  Her 
compensation  is  directly  tied  to  Facebook’s  revenues  that  are  generated  from  the  sale  of 
targeted  advertising  services,  and  she  has  acted  and  will  continue  to  prioritize  profitability  over 
complying  with  the  law.  Demand  is,  therefore,  futile  as  to  defendant  Sandberg. 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

114 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


ase  4:18-cv-01792-HSG  Document  124-2  Filed  08/01/19  Page  121  of  143 

4.  Defendant  Desmond-Hellmann  Lacks  Independence 

392.  Defendant  Desmond-Hellmann  is  chief  executive  of  the  Gates  Foundation,  and 

formerly  served  as  an  executive  at  Genentech  and  as  a  director  at  Procter  &  Gamble.  It  is  no 
coincidence  that  she  is  one  of  the  newest  Facebook  directors,  and  one  of  the  only  members  of 
Facebook’s  Board  that  does  not  have  extensive  experience  and  a  background  in  tech 
entrepreneurship.  Defendant  Zuckerberg  has  surrounded  himself  with  Silicon  Valley 
entrepreneurs  on  Facebook’s  Board  who  have  interests  that  are  closely  aligned  with  his, 
making  it  extremely  difficult  for  new  directors  and  shareholders  alike  to  protest  his  decisions, 
because  he  usually  does  not  face  much  if  any  opposition  in  policy  matters. 

393.  Defendant  Desmond-Hellman  lacks  independence  from  defendant  Zuckerberg, 
and  she  has  already  demonstrated  that  she  will  not  take  any  action  to  oppose  his  wishes  or  the 
other  directors.  In  April  2016,  when  Zuckerberg  announced  a  plan  to  issue  new  “Class  C” 
shares  with  no  voting  rights,  that  would  allow  him  to  sell  the  majority  of  his  shares  for  billions 
of  dollars,  while  simultaneously  retaining  total  control  over  decision-making,  Desmond- 
Hellmann  initially  objected  to  the  share  reclassification,  legal  briefs  filed  in  the  case  show. 
However,  fellow  board  members  eventually  swayed  her  to  vote  in  his  favor,  highlighting  her 
willingness  to  cede  to  Zuckerberg’ s  views  even  when  they  conflict  with  her  own  views  of  what 
is  best  for  the  Company  and  its  shareholders. 

394.  As  the  lead  director  of  Facebook’s  Board,  defendant  Desmond-Hellman  made  a 
public  statement  following  the  break  of  the  Cambridge  Analytica  story,  saying  that  the  Board 
supported  both  defendants  Zuckerberg  and  Sandberg.  It  was  the  Board’s  only  comment  about 
the  revelations,  confirming  once  again  that  Desmond-Hellman  will  not  take  any  position 
against  Zuckerberg,  even  in  a  statement,  let  alone  commence  litigation  against  him. 

5.  Defendant  Chenault  Lacks  Independence 

395.  On  January  1 8,  201 8,  Facebook  announced  that  the  Company  added  a  new 

member  to  its  board  of  directors:  Ken  Chenault  (“Chenault”),  then  CEO  of  American  Express. 
Chenault  is  the  first  new  director  since  defendant  Koum  joined  Facebook’s  Board  in  2014. 
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396.  Defendant  Zuckerberg  announced  the  new  appointment  in  a  Facebook  post, 
claiming  he’s  been  “trying  to  recruit  Ken  for  years.”  “He  has  unique  expertise  in  areas  I  believe 
Facebook  needs  to  learn  and  improve  —  customer  service,  direct  commerce,  and  building  a 
trusted  brand,”  Zuckerberg  added.  “Adding  someone  to  our  board  is  one  of  the  most  important 
decisions  our  board  makes.  It’s  a  long  process  that  I  take  very  seriously  since  this  is  the  group 
that  ultimately  governs  Facebook.  Ken  and  I  have  had  dinners  discussing  our  mission  and 
strategy  for  years,  and  he  has  already  helped  me  think  through  some  of  the  bigger  issues  I’m 
hoping  we  take  on  this  year.” 

397.  Defendant  Chenault  lacks  independence  from  Zuckerberg  and  is  beholden  to 
Zuckerberg  because  he  appointed  Chenault  to  Facebook’s  Board.  Chenault  has  received  and 
continues  to  receive  lucrative  compensation  and  benefits,  including  personal  reputational 
benefits  and  prestige  that  is  associated  with  and  is  solely  the  result  of  his  position  on 
Facebook’s  Board,  and  he  will  not  commence  litigation  against  Zuckerberg  or  take  any  other 
action  that  would  threaten  his  position  and  the  lucrative  compensation  and  benefits  that  he 
receives  as  a  Facebook  director. 

6.  Defendant  Zients  Lacks  Independence 

398.  In  201 8,  defendant  Zuckerberg  selected  defendant  Zients  to  replace  defendant 

Koum  as  a  director  on  Facebook’s  Board,  after  the  2018  Proxy  Statement  was  issued  and 
before  the  stockholder  meeting,  but  no  vote  was  required.  Defendant  Zuckerberg  thus 
effectively  unilaterally  appointed  Zients  to  the  Board  for  the  entire  year. 

399.  Defendant  Zients  lacks  independence  from  Zuckerberg  and  is  beholden  to 
Zuckerberg  because  he  appointed  Zients  to  Facebook’s  Board.  Zients  has  received  and 
continues  to  receive  lucrative  compensation  and  benefits,  including  personal  reputational 
benefits  and  prestige  that  is  associated  with  and  is  solely  the  result  of  his  position  on 
Facebook’s  Board,  and  he  will  not  commence  litigation  against  Zuckerberg  or  take  any  other 
action  that  would  threaten  his  position  and  the  lucrative  compensation  and  benefits  that  he 
receives  as  a  Facebook  director. 
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7.  Facebook  Director  Peggy  Alford  Lacks  Independence 

400.  On  April  12,  2019,  Facebook  issued  a  press  release  announcing  that  Peggy 
Alford  (“Alford”)  had  been  nominated  for  election  to  Facebook’ s  Board  at  the  Company’s 
annual  meeting  of  stockholders  to  be  held  on  May  30,  2019.  Alford  is  Senior  Vice  President, 
Core  Markets  of  PayPal  Holdings,  Inc.,  a  digital  payments  company,  since  March  2019,  and 
she  previously  held  a  variety  of  other  senior  positions  at  PayPal  from  May  2011  until 
September  2017,  when  she  began  working  for  defendant  Zuckerberg  at  his  “philanthropic 
organization.” 

401 .  Alford  was  Chief  Financial  Officer  and  Head  of  Operations  at  the  Chan 
Zuckerberg  Initiative  until  February  2019,  when  she  left  so  that  she  could  join  Facebook’s 
Board.  Alford’s  background  is  in  finance,  and  in  her  position  as  Chief  Financial  Officer  and 
Head  of  Operations  for  the  Chan  Zuckerberg  Initiative,  she  was  able  to  oversee  and  manage  the 
financial  and  accounting  intricacies  associated  with  the  massive  amounts  of  shares  of  Facebook 
stock  that  defendant  Zuckerberg  began  offloading  to  the  organization  in  2017,  with  the  blessing 
of  Facebook’s  Board,  to  avoid  tax  consequences,  while  at  the  same  time  retaining  his  majority 
voting  power,  through  his  continued  voting  and  decision-making  control  with  respect  to  those 
shares. 

402.  When  Facebook’s  Board  originally  announced  the  planned  sell-off  by  Zuckerberg 
of  his  sahares  in  a  Form  8-K  that  Facebook  filed  with  the  SEC  in  September  2017,  Defendants 
disclosed  that  Zuckerberg  anticipated  selling  35  million  to  75  million  shares  of  Facebook  stock 
over  a  period  of  approximately  1 8  months  from  the  date  of  the  announcement,  or  until 
approximately  March  2019.  However,  the  Board  subsequently  disclosed  in  Item  9B  of 
Facebook’s  2018  Form  10-K  that  Zuckerberg  “intends  to  continue  to  sell  shares  of  Facebook 
stock  from  time  to  time,  primarily  to  continue  to  fund  his  philanthropic  initiatives”  -  further 
evidence  of  Zuckerberg’ s  domination  and  control  over  Facebook  and  its  Board. 

403.  Alford  has  a  long  history  in  the  tech  industry,  and  over  the  years  she  has  worked 
with,  and  for,  other  companies  founded  by  Facebook  directors  besides  defendant  Zuckerberg, 
including  current  Board  member  defendant  Thiel.  Defendant  Thiel  is  a  co-founder  of  PayPal, 
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which  was  acquired  by  eBay  in  2002.  Alford  was  eBay’s  Marketplace  Controller  and  Director 
of  Accounting  Policy  from  2002  until  2005,  and  she  held  various  officer  positions  at  Rent.com, 
another  eBay  Inc.  company,  from  2005  until  2011,  when  she  began  working  for  PayPal 
Holdings. 

404.  Thus,  it  is  no  surprise  that  when  Facebook  announced  that  Alford  would  join 
Facebook’s  Board  in  the  April  12,  2019  press  release,  she  paid  lip  service  to  the  Board’s  “drive 
and  desire  to  face  hard  issues  head-on”  and  specifically  named  Zuckerberg  in  her  statement  that 
was  quoted  in  the  press  release:  “I  look  forward  to  working  with  Mark  and  the  other  directors 
as  the  company  builds  new  and  inspiring  ways  to  help  people  connect  and  build  community.” 

405.  Defendant  Zuckerberg  likewise  expressed  his  admiration  for  Alford  in  the  press 
release  and  alluded  to  their  close  working  relationship,  stating,  “Peggy  is  one  of  those  rare 
people  who's  an  expert  across  many  different  areas  -  from  business  management  to  finance 
operations  to  product  development.  I  know  she  will  have  great  ideas  that  help  us  address  both 
the  opportunities  and  challenges  facing  our  company.” 

•  406.  Alford  lacks  independence  from  Zuckerberg  and  is  beholden  to  Zuckerberg 
because  he  appointed  Alford  to  Facebook’s  Board.  Alford  has  received  and  continues  to 
receive  lucrative  compensation  and  benefits,  including  personal  reputational  benefits  and 
prestige  that  is  associated  with  and  is  solely  the  result  of  her  position  on  Facebook’s  Board,  and 
she  will  not  commence  litigation  against  Zuckerberg  or  take  any  other  action  that  would 
threaten  her  position  and  the  lucrative  compensation  and  benefits  that  she  receives  as  a 
Facebook  director. 

407.  For  all  of  the  foregoing  reasons,  demand  on  Facebook’s  Board  was  futile,  and 
therefore,  excused. 

FIRST  CAUSE  OF  ACTION 

Declaratory  Relief  Pursuant  to  Code  of  Civil  Procedure,  §  1060,  et  seq. 

(Declaratory  Judgment  That  Facebook’s  Forum  Provision  is  Invalid  and  Unenforceable) 

408.  Plaintiff  realleges  and  incorporates  by  reference  the  allegations  above  as  though 
fully  set  forth  herein. 
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409.  An  actual  controversy  has  arisen  and  now  exists  between  Plaintiff  and  Facebook 
and/or  its  Board.  As  alleged  above,  Plaintiff  contends  that  the  “Choice  of  Forum”  provision  in 
Article  IX  of  Facebook’s  Restated  Certificate  of  Incorporation  (the  Forum  Provision)  is  invalid 
on  its  face,  and  as  applied  to  the  causes  of  action  that  Plaintiff  alleges  and  seeks  to  assert 
derivatively  on  behalf  of  Facebook  in  this  Complaint,  and  that  the  Forum  Provision  is 
unenforceable  in  the  State  of  California. 

410.  A  judicial  determination  of  these  issues  and  of  the  respective  rights  of  Plaintiff, 
as  a  shareholder  of  Facebook  and  a  California  resident,  and  Nominal  Defendant  Facebook,  and 
of  the  respective  duties  of  Plaintiff,  on  behalf  of  Nominal  Defendant  Facebook,  and  the 
Individual  Defendants  who  are  members  of  Facebook’s  Board  of  Directors  is  appropriate.  As 
alleged  herein,  Plaintiff  asserts  the  Second  through  Fifth  Causes  of  Action  under  the  California 
Corporations  Code  derivatively  on  behalf  of  Facebook,  and  the  Forum  Provision  seeks  to 
prevent  Plaintiff  and  any  other  shareholder  of  Facebook  from  asserting  such  causes  of  action  in 
this  Court,  against  the  Individual  Defendants  and/or  derivatively  on  behalf  of  Facebook, 
because  the  Forum  Provision  purports  to  require  that  any  derivative  action  and  any  claims 
against  Facebook’s  directors  and  officers,  including  the  Individual  Defendants,  must  be 
brought  in  the  Court  of  Chancery  of  the  State  of  Delaware,  which  is  the  sole  and  exclusive 
forum  that  is  designated  by  the  Forum  Provision. 

411.  A  judicial  determination  of  the  parties’  respective  rights  and  remedies  is 
necessary  and  appropriate  at  this  time  under  the  circumstances  because:  (i)  the  Forum 
Provision  has  been  asserted  by  Facebook  and/or  Individual  Defendants  as  a  defense  to  similar 
derivative  claims  against  Individual  Defendants  under  the  California  Corporations  Code  arising 
from  the  same  facts  and  circumstances  as  this  action,  and  to  obtain  a  dismissal  of  those  claims 
without  prejudice;  (ii)  Facebook’s  Board  approved  Facebook’s  Amended  and  Restated  Bylaws, 
as  amended  and  restated  April  10, 2019,  which  provide  that  the  Forum  Provision  is  subject  to 
modification,  waiver  or  repeal  only  by  Facebook  directors  including  Individual  Defendants; 
and  (iii)  Plaintiff  is  presently  asserting  causes  of  action  under  the  California  Corporations  Code 
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derivatively  on  behalf  of  Facebook  against  the  Individual  Defendants,  as  alleged  in  this 
Complaint,  in  this  California  Superior  Court.  A  judicial  determination  is  necessary  to  prevent 
the  causes  of  action  alleged  herein  from  being  dismissed  on  the  basis  of  the  Forum  Provision. 

412.  Plaintiff  now  seeks  a  declaratory  judgment  that:  (1)  this  Court  has  jurisdiction 
and  authority  to  issue  judgment  on  all  of  the  causes  of  action  in  this  Complaint,  including  the 
authority  to  determine  the  validity  and/or  enforceability  of  the  Forum  Provision;  (2)  the  Forum 
Provision  is  invalid  under  applicable  Delaware  and/or  California  law;  (3)  the  Forum  Provision 
is  unenforceable  (a)  in  the  State  of  California,  either  because  it  is  against  public  policy  and/or 
because  it  seeks  to  limit  statutory  rights  and  remedies  under  California  law,  or,  alternatively, 

(b)  as  to  Plaintiff  in  this  action  and/or  the  causes  of  action  alleged  in  this  Complaint;  and  (4) 
the  Forum  Provision  was  adopted,  has  not  been  waived  or  modified  and/or  is  maintained  by 
Facebook’s  Board,  including  Individual  Defendants  who  are  directors,  for  an  improper  purpose 
that  is  inconsistent  with  their  fiduciary  duties  owed  to  Facebook  and  its  minority  shareholders; 
and  (5)  the  Forum  Provision  was  expressly  or  tacitly  approved  by  Facebook’s  Board  through  its 
adoption  of  Facebook’s  Amended  and  Restated  Bylaws,  as  amended  and  restated  April  10, 
2019,  which  Facebook’s  Board,  including  Individual  Defendants  who  are  directors,  adopted 
and/or  approved  for  an  improper  purpose  that  is  inconsistent  with  their  fiduciary  duties  and 
which  constitutes  a  breach  of  their  fiduciary  duties  owed  to  Facebook  and  its  minority 
shareholders,  because  Facebook’s  Amended  and  Restated  Bylaws  do  not  modify  or  allow  for 
modification  of  the  Forum  Provision  and  impose  certain  requirements  that  must  be  met  in  order 
to  modify  the  Forum  Provision  that  prevent  Plaintiff  and  Facebook’s  minority  shareholders 

from  voting  to  modify  the  Forum  Provision. 

SECOND  CAUSE  OF  ACTION 

Violations  of  Corporations  Code  §§  24400, 25500,  et  seq. 

(Derivatively  on  Behalf  of  Facebook  Against  the  Individual  Defendants) 

413.  Plaintiff  realleges  and  incorporates  by  reference  the  allegations  above  as  though 
fully  set  forth  herein. 
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414.  During  the  relevant  period,  each  of  the  Individual  Defendants:  (i)  approved 
Facebook’s  stock  repurchase  program  in  2016  and/or  increases  to  the  amount  of  the  original 
share  repurchase  authorization  and  subsequent  authorizations  in  2017,  2018  and/or  2019;  or  (ii) 
approved,  authorized  and/or  effectuated  share  repurchases  by  Facebook  or  sold  their  own 
personally-held  shares  of  Facebook  Class  A  common  stock  during  the  same  time  that  the 
Company  was  repurchasing  its  shares  in  2017,  2018  and/or  2019.  Pursuant  to  these 
authorizations  and  approvals,  Facebook  repurchased  hundreds  of  thousands  of  shares  of  its 
Class  A  common  stock  during  the  relevant  period  in  the  open  market  and  from  Individual 
Defendants,  directly  and  indirectly,  including  at  regular  market  prices,  for  total  purchase  prices 
of  at  least  $6  billion  in  2017,  at  least  $9  billion  in  2018,  and  up  to  $9  billion  in  2019. 

415.  In  connection  with  Facebook’s  share  repurchases,  the  Individual  Defendants 
made  or  caused  to  be  made  by  or  on  behalf  of  Facebook  false  and  misleading  statements  and/or 
omissions  as  described  above,  which  the  Individual  Defendants  knew  or  recklessly  disregarded 
were  materially  false,  misleading  and/or  incorrect  and  were  intended  to  deceive  or  defraud  the 
public  (including  Plaintiff  and  Facebook’s  minority  shareholders)  and  to  manipulate  the  market 
for  Facebook  securities  by  artificially  inflating  the  market  price  of  shares  of  Facebook  Class  A 
common  stock.  Those  false  and  misleading  statements  or  omissions  were  made,  authorized,  or 
approved  by  the  Individual  Defendants  intentionally  as  part  of  a  course  of  conduct  that  was 
intended  to,  and  did,  manipulate  the  market  for  Facebook  securities  by  artificially  inflating  the 
price  of  Facebook’s  common  stock. 

416.  At  the  same  time  that  the  price  of  Facebook’s  common  stock  was  artificially 
inflated  due  to  the  false  and  misleading  statements  or  omissions  as  described  above,  the 
Individual  Defendants  caused  Facebook  to  repurchase  millions  of  shares  of  its  Class  A 
common  stock,  including  in  the  open  market,  at  prices  that  were  higher  than  the  prices  that 
Facebook  would  have  paid  for  the  shares  had  the  Company’s  stock  price  not  been  artificially 
inflated  due  to  the  false  and  misleading  statements  or  omissions  that  the  Individual  Defendants 
made  or  caused  to  be  made  by  or  on  behalf  of  Facebook  as  described  above. 
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417.  The  Individual  Defendants  engaged  in  a  scheme  that  deceived  or  defrauded 
Facebook  by  causing  the  Company  to  purchase  shares  of  its  stock  at  artificially  inflated  prices 
that  were  higher  than  the  price  Facebook  would  have  paid  for  its  shares  had  its  stock  price  not 
been  artificially  inflated  due  to  the  Individual  Defendants’  false  and  misleading  statements  or 
omissions  as  described  above. 

418.  The  Individual  Defendants  violated  Corporations  Code  section  25400  in  that  they 
made  untrue  statements  of  material  facts  or  omitted  to  state  material  facts  necessary  in  order  to 
make  the  statements  made,  in  light  of  the  circumstances  under  which  they  were  made,  not 
misleading,  and  they  engaged  in  acts,  practices,  and/or  a  course  of  business  that  manipulated 
the  market  for  Facebook  stock,  and  thereby  operated  as  a  fraud  or  deceit  upon  Facebook  in 
connection  with  its  share  repurchases  during  the  relevant  period. 

419.  As  described  above,  the  Individual  Defendants  acted  with  intent  to  deceive, 
manipulate,  or  defraud  the  market,  by  issuing  materially  false  and  misleading  statements  and 
omissions,  including  in  Facebook’ s  proxy  statements,  quarterly  and  annual  reports,  and  other 
public  filings  with  the  SEC,  in  press  releases  and  on  conference  calls  with  analysts  and 
investors,  and  in  Facebook  Newsroom  posts,  on  Mark  Zuckerberg’s  Facebook  page,  and  on 
other  pages  of  Facebook’s  website,  to  various  media  outlets,  in  live  and  written  testimony  to 
Congress  and  other  government  agencies,  and  to  Facebook’s  regulators,  which  contained 
omissions  and  misrepresentations  that  the  Individual  Defendants  knew:  (i)  were  misleading;  (ii) 
failed  to  disclose  material  facts  and  information  that  was  required  to  be  disclosed  under 
applicable  laws  and  regulations,  or  that  the  Individual  Defendants  knew  was  necessary  to  make 
Defendants’  statements  not  misleading;  and/or  (iii)  caused  Facebook’s  stock  price  to  trade  at 
higher  prices  than  if  the  omitted  facts  were  disclosed,  or  if  the  facts  had  been  disclosed 
truthfully,  including  material  facts  and  information  related  to  the  Company’s  core  advertising 
business,  advertising  services,  policies,  practices,  and  internal  controls,  including  relating  to 
user  privacy,  information,  and  data  security. 
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420.  Defendants’  statements  were  false  and  misleading  because  they  failed  to  state  or 
omitted  material  facts  and  did  not  disclose  information  regarding,  among  other  things:  (i)  the 
misappropriation  of  user  information  by  Cambridge  Analytica  and  other  third  parties;  (ii) 
Defendants’  knowledge  that  Facebook’s  internal  controls  and  systems  were  inadequate  and 
ineffective  to  protect  user  data;  (iii)  Defendants’  knowledge  of  data  security  failures  that  had 
actually  materialized  and  had  not  been  disclosed;  (iv)  the  fact  that  Facebook’s  internal  controls 
and  systems  were  inadequate  to  ensure  that  the  Company  complied  with  applicable  notification 
and  disclosure  requirements,  including  with  respect  to  the  Cambridge  Analytica  incident;  (v) 
the  fact  that  Defendants  failed  to  maintain  appropriate  policies  and  procedures  to  detect  and 
prevent  violations  of  Facebook’s  policies;  and  (vi)  the  fact  that  Defendants  failed  to 
appropriately  address  Facebook’s  privacy  practices  and  misleading  claims  regarding  same  as 
required  by  the  FTC  Consent  Decree;  and  (vii)  Facebook’s  violations  and  potential  violations 
of  various  U.S.  and  foreign  laws  and  regulations,  including  the  FTC  Consent  Order. 

421 .  In  connection  with  the  share  repurchases,  the  Individual  Defendants  acted  either 
with  intent  to  deceive,  manipulate,  or  defraud,  or  with  severe  recklessness.  The  Individual 
Defendants  caused  Facebook  to  expend  corporate  funds  to  repurchase  shares  of  its  stock  while 
it  was  trading  at  prices  that  were  artificially  inflated  by  the  false  and  misleading  statements  that 
the  Individual  Defendants  issued  with  intent  to  deceive,  manipulate,  or  defraud,  which  were 
made  in  connection  with  the  purchase  or  sale  of  Facebook  stock,  as  described  above. 
Facebook’s  repurchases  of  its  shares  of  its  common  stock  while  it  was  trading  at  artificially 
inflated  prices  were  approved  and/or  authorized  by  the  Individual  Defendants  for  an  improper 
purpose,  i.e.,  to  manipulate  the  market  for  Facebook  securities. 

422.  The  Individual  Defendants’  market  manipulation  and  their  acts  in  connection 
with  the  stock  repurchases  and  other  wrongful  conduct  described  above  violated  Corporations 
Code  section  25400. 

423.  The  Individual  Defendants  were  among  the  senior  management  and  the  directors 
of  the  Company,  and  were  therefore  directly  responsible  for,  and  are  liable  for,  the  materially 
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false  and  misleading  statements  and  omissions  that  artificially  inflated  Facebook’s  stock  price 
and  manipulated  the  market  for  Facebook  securities,  and  for  approving  the  share  repurchase 
program  and/or  share  repurchase  authorization(s)  pursuant  to  which  the  share  repurchases 
described  above  were  effectuated  by  or  on  behalf  of  Facebook. 

424.  As  a  result  of  the  Individual  Defendants’  violations  of  Corporations  Code  section 
25400,  Facebook  suffered  damages  in  connection  with  its  purchases  of  shares  of  Facebook 
stock.  By  reason  of  such  conduct,  the  Individual  Defendants  are  liable  to  Facebook  for  the 
damages  that  it  sustained  as  a  result  of  their  violations  of  Corporations  Code  section  25400, 
pursuant  to  Corporations  Code  section  25500. 

425.  Pursuant  to  the  provisions  of  Corporations  Code  section  25500,  Plaintiff,  on 
behalf  of  Facebook,  is  entitled  to  rescind  the  sales  of  the  repurchased  shares  described  above 
and  recover  from  Individual  Defendants  the  consideration  that  Facebook  paid  for  the  shares, 
plus  interest  at  the  legal  rate,  in  amounts  to  be  determined  after  discovery  which  reflect  the 
artificial  inflation  in  Facebook’s  stock  price  that  was  due  to  the  false  and  misleading  statements 
and  omissions  and  other  conduct  by  the  Individual  Defendants  that  manipulated  the  market  for 
Facebook  securities  and  caused  the  Company  to  repurchase  shares  of  its  common  stock  at 
higher  prices  than  Facebook  would  have  paid  for  the  shares  were  it  not  for  the  Individual 
Defendants’  violations  of  Corporations  Code  section  25400  described  above. 

426.  Each  of  the  Individual  Defendants,  through  their  positions  as  officers  and/or 
directors  of  Facebook,  directly  or  indirectly  controls  persons,  including  other  Individual 
Defendants  who  are  liable  under  Corporations  Code  section  25500  for  false  and  misleading 
statements  as  alleged  herein,  and  is  also  liable  jointly  and  severally  with  and  to  the  same  extent 

as  those  persons,  pursuant  to  Corporations  Code  section  25504. 

\ 

427.  Alternatively,  at  all  times  mentioned  in  this  complaint,  each  of  the  Individual 
Defendants,  with  the  intent  to  deceive  or  defraud  the  public  (including  Plaintiff  and  Facebook’s 
minority  shareholders),  materially  assisted  other  Individual  Defendants  in  violating  section 
25400  of  the  Corporations  Code  in  that  they  signed,  approved,  authorized,  issued  and/or 
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disseminated  the  false  and  misleading  statements  or  omissions  described  above,  which  the 
Individual  Defendants  knew  or  recklessly  disregarded:  (i)  were  materially  false  and/or 
incorrect;  or  (ii)  omitted  and  failed  to  disclose  material  facts  and  information  that  was  required 
to  be  disclosed  under  applicable  laws  and  regulations,  or  that  the  Individual  Defendants  knew 
was  necessary  to  make  Defendants’  statements,  in  light  of  circumstances  under  which  they 
were  made,  not  misleading,  which  caused  Facebook’s  stock  price  to  trade  at  higher  prices  than 
if  the  omitted  facts  were  disclosed,  or  if  the  facts  had  been  disclosed  truthfully.  As  a  result, 
each  of  the  Individual  Defendants  is  jointly  and  severally  liable  for  the  violation  of 
Corporations  Code  section  25400  described  in  this  complaint,  pursuant  to  Corporations  Code 
section  25504.1. 

428.  Plaintiff,  on  behalf  of  Facebook,  has  no  adequate  alternative  remedy  under 
Delaware  law. 

THIRD  CAUSE  OF  ACTION 

Violations  of  Corporations  Code  §§  25401,  25501,  et  seq. 

(Derivatively  on  Behalf  of  Facebook  Against  the  Individual  Defendants) 

429.  Plaintiff  incorporates  by  reference  and  realleges  each  of  the  allegations  set  forth 
above  as  though  fully  set  forth  herein. 

430.  Plaintiff  is  an  individual,  and  is  now,  and  at  all  relevant  times  was,  a  resident  of 
San  Francisco  County,  California,  and  a  shareholder  of  Facebook  Class  A  common  stock, 
which  Plaintiff  has  held  continuously  during  the  relevant  period  of  conduct  described  in  this 
Complaint. 

43 1 .  Nominal  Defendant  Facebook  is  now,  and  at  all  relevant  times  mentioned  in  this 
Complaint  was,  a  corporation  organized  and  existing  under  the  laws  of  the  State  of  Delaware, 
with  its  principal  place  of  business  in  San  Mateo  County,  California. 

432.  Individual  Defendants  are  now,  and  at  all  relevant  times  mentioned  in  this 
Complaint  were,  California  residents,  including  as  follows: 

•  Defendant  Zuckerberg  is  a  resident  of  San  Mateo  County,  California; 

•  Defendant  Sandberg  is  a  resident  of  San  Mateo  County,  California; 
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•  Defendant  Andreessen  is  a  resident  of  San  Mateo  County,  California;  and 

•  Defendant  Koum  is  a  resident  of  Santa  Clara  County,  California. 

433.  Beginning  in  January  of  2017,  on  various  dates  throughout  2017,  Facebook 
repurchased  $6  billion  worth  of  shares  of  its  Class  A  common  stock  at  regular  market  prices, 
while  at  the  same  time  the  Individual  Defendants  sold  their  personally  held  shares  of  Facebook 
Class  A  common  stock  into  the  open  market  at  market  prices,  and  the  Individual  Defendants 
caused  Facebook  to  sell  and  Facebook  sold  shares  of  its  Class  A  common  stock  to  the  public 
pursuant  to  its  Registration  Statement  on  Form  8-A  filed  with  the  SEC  on  May  13, 2012, 
including  any  amendments  or  reports  filed  for  the  purpose  of  updating  such  description. 

434.  The  Individual  Defendants  offered  to  sell,  and  sold,  the  shares  of  Facebook  stock 
described  above  by  means  of  written  and  oral  communications  which  included  and  expressly 
incorporated  statements  that  were  materially  misleading,  untrue  or  incorrect  and/or  contained 
omissions  of  material  fact  that  failed  to  disclose  information  that  was  necessary  to  make  the 
statements  made,  in  light  of  the  circumstances  under  which  they  were  made,  not  misleading,  in 
that  the  Individual  Defendants  signed,  authorized,  approved,  disseminated,  issued,  caused 
Facebook  to  issue,  and/or  issued  on  Facebook’s  behalf,  statements  that  were  materially  false, 
misleading  and/or  incorrect  or  that  omitted  and  failed  to  disclose  material  facts  and  information 
that  was  necessary  to  make  the  statements  in  Facebook’s  public  filings  with  the  SEC,  press 
releases,  on  conference  calls  with  securities  analysts  and  investors,  in  Facebook  Newsroom 
posts,  on  Mark  Zuckerberg’s  Facebook  page,  to  various  media  outlets,  in  live  and  written 
testimony  to  Congress  and  various  other  government  agencies,  and  that  were  provided  to 
Facebook’s  regulators,  not  misleading,  including  facts  and  information  regarding,  among  other 
things:  (i)  the  misappropriation  of  user  information  by  Cambridge  Analytica  and  other  third 
parties;  (ii)  Defendants’  knowledge  that  Facebook’s  internal  controls  and  systems  were 
inadequate  and  ineffective  to  protect  user  data;  (iii)  Defendants’  knowledge  of  data  security 
failures  that  had  actually  materialized  and  had  not  been  disclosed;  (iv)  the  fact  that  Facebook’s 
internal  controls  and  systems  were  inadequate  to  ensure  that  the  Company  complied  with 
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applicable  notification  and  disclosure  requirements,  including  with  respect  to  the  Cambridge 

l 

Analytica  incident;  (v)  the  fact  that  Defendants  failed  to  maintain  appropriate  policies  and 
procedures  to  detect  and  prevent  violations  of  Facebook’s  policies;  and  (vi)  the  fact  that 
Defendants  failed  to  appropriately  address  Facebook’s  privacy  practices  and  misleading  claims 
regarding  same  as  required  by  the  FTC  Consent  Order;  and  (vii)  the  fact  that,  as  a  result  of  the 
foregoing,  Facebook  was  liable  for  damages,  including  fines  and  penalties,  and  various  other 
costs  incurred  in  connection  with  adjudicated  violations  and  potential  violations  of  various  U.S. 
and  foreign  laws,  regulations,  and  the  FTC  Consent  Order. 

435.  The  statements  and  omissions  made  by  or  on  behalf  of  Defendants  described 
above  were  untrue  or  misleading  in  that  they  omitted  material  facts  and  failed  to  disclose, 
among  other  things:  (i)  the  misappropriation  of  user  information  by  Cambridge  Analytica  and 
other  third  parties;  (ii)  Defendants’  knowledge  that  Facebook’s  internal  controls  and  systems 
were  inadequate  and  ineffective  to  protect  user  data;  (iii)  Defendants’  knowledge  of  data 
security  failures  that  had  actually  materialized  and  had  not  been  disclosed;  (iv)  the  fact  that 
Facebook’s  internal  controls  and  systems  were  inadequate  to  ensure  that  the  Company 
complied  with  applicable  notification  and  disclosure  requirements,  including  with  respect  to  the 
Cambridge  Analytica  incident;  (v)  the  fact  that  Defendants  failed  to  maintain  appropriate 
policies  and  procedures  to  detect  and  prevent  violations  of  Facebook’s  policies;  and  (vi)  the 
fact  that  Defendants  failed  to  appropriately  address  Facebook’s  privacy  practices  and 
misleading  claims  regarding  same  as  required  by  the  FTC  Consent  Decree;  and  (vii)  that,  as  a 
result  of  the  foregoing,  Facebook  violated  various  U.S.  and  foreign  laws  and  regulations,  and 
the  FTC  Consent  Decree. 

436.  The  Individual  Defendants  knew  and/or  recklessly  disregarded  that  these 
statements  were  materially  false  or  misleading,  or  contained  omissions  of  material  facts  and 
information  that  was  necessary  to  make  the  statements  correct  and/or  not  misleading,  and  they 
were  intended  to  deceive  or  defraud  the  public  and  to  induce  the  purchase  of  shares  of 
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Facebook  Class  A  common  stock  by  the  public  at  prices  that  were  artificially  inflated  due  to 
their  materially  false  and  misleading  statements  and/or  omissions. 

437.  As  described  above,  the  Individual  Defendants  acted  intentionally  to  deceive, 
manipulate,  or  defraud  the  market,  by  issuing  materially  false  and  misleading  statements  and 
omissions,  including  in  Facebook’s  proxy  statements,  quarterly  and  annual  reports,  and  other 
public  filings  with  the  SEC,  in  press  releases  and  on  conference  calls  with  analysts  and 
investors,  and  in  Facebook  Newsroom  posts,  on  Mark  Zuckerberg’s  Facebook  page,  and  on 
other  pages  of  Facebook’s  website,  to  various  media  outlets,  in  live  and  written  testimony  to 
Congress  and  other  government  agencies,  and  to  Facebook’s  regulators,  which  contained 
omissions  and  misrepresentations  that  the  Individual  Defendants  knew  they:  (i)  were  materially 
false  and/or  incorrect;  (ii)  failed  to  disclose  material  facts  and  information  that  was  required  to 
be  disclosed  under  applicable  laws  and  regulations,  or  that  the  Individual  Defendants  knew  was 
necessary  to  make  Defendants’  statements,  in  light  of  circumstances  under  which  they  were 
made,  not  misleading;  and/or  (iii)  caused  Facebook’s  stock  price  to  trade  at  higher  prices  than 
if  the  omitted  facts  were  disclosed,  or  if  the  facts  had  been  disclosed  truthfully,  including 
material  facts  and  information  related  to  the  Company’s  core  advertising  business,  targeted 
advertising  services,  and  Facebook’s  policies,  practices,  and  internal  controls  respecting 
compliance  with  applicable  laws  and  the  expectations  of  its  users  respecting  their  personal 
information,  data,  privacy  and  security. 

438.  The  Individual  Defendants  violated  Corporations  Code  section  25401  in  that  they 
made  untrue  statements  of  material  facts  or  omitted  to  state  material  facts  necessary  in  order  to 
make  the  statements  made,  in  light  of  the  circumstances  under  which  they  were  made,  not 
misleading,  which  thereby  operated  as  a  fraud  or  deceit  upon  Facebook  in  connection  with  its 
repurchases  of  shares  of  Facebook  stock  at  artificially  inflated  prices  during  the  relevant  period. 

439.  Plaintiff  and  the  general  public,  including  Facebook’s  minority  shareholders  that 
were  not  Company  insiders  and/or  employees,  did  not  know  that  the  statements  made  by 
Defendants  described  above  were  untrue  or  the  omitted  facts  that  were  material  information 
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that  was  necessary  to  make  the  statements  not  misleading  in  light  of  the  circumstances  in  which 
they  were  made.  If  Plaintiff  and  the  general  public  (including  Facebook’s  minority 
shareholders)  had  known  that  the  statements  made  by  Defendants  described  above  were  untrue 
or  the  material  facts  and  information  omitted  by  Defendants  made  Defendants’  other  statements 

I 

misleading,  Facebook  would  not  have  repurchased  its  shares  of  stock  described  above,  at  all,  or 
at  the  prices  it  paid  to  repurchase  these  shares,  in  the  open  market,  from  Individual  Defendants 
and/or  at  the  same  time  the  Individual  Defendants  were  selling  their  personally-held  shares  of 
Facebook  at  artificially  inflated  prices,  which  were  higher  than  they  would  have  been  if  the 
statements  were  true  and/or  if  the  relevant  material  facts  and  information  were  disclosed. 

440.  As  of  the  date  this  Complaint  was  filed,  Facebook  had  received  income  on  the 
shares  in  various  amounts  to  be  determined  after  discovery,  which,  on  information  and  belief, 

f 

are  lesser  than  the  amounts  Facebook  paid  to  repurchase  the  shares. 

441 .  Facebook  subsequently  sold  the  shares  of  its  Class  A  common  stock  to  the  public 
at  market  prices  during  2017,  2018,  and/or  2019. 

442.  The  Individual  Defendants’  conduct  as  described  above  was  in  violation  of  Corp. 
Code  section  25401 . 

443.  As  a  direct  and  proximate  result  of  the  Individual  Defendants’  violations  of 
Corporations  Code  section  25401,  Facebook  suffered  damages  in  that  it  paid  a  higher  price  for 
the  shares  it  repurchased  pursuant  to  the  share  repurchase  program  and/or  share  repurchase 
authorization(s)  that  were  approved  by  Facebook’s  Board,  when  the  previously  undisclosed 
facts  were  revealed  and/or  disclosed  beginning  in  March  2018.  Facebook  would  not  have 
purchased  these  securities  at  the  prices  it  paid,  or  at  all,  but  for  the  artificial  inflation  in  the 
Company’s  stock  price  caused  by  Defendants’  false  or  misleading  statements. 

444.  Pursuant  to  Corporations  Code  section  25501,  Plaintiff,  on  behalf  of  Facebook,  is 
entitled  to  recover  from  Individual  Defendants  an  amount  equal  to  the  difference  between  the 
price  at  which  the  shares  were  repurchased  by  Facebook  plus  interest  at  the  legal  rate  from  the 
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date  of  purchase,  and  the  value  of  the  shares  at  the  time  they  were  sold  by  Facebook  plus  the 
amount  of  any  income  received  on  the  securities  by  Facebook. 

445.  Each  of  the  Individual  Defendants,  through  their  positions  as  officers  and/or 
directors  of  Facebook,  directly  or  indirectly  controls  persons,  including  other  Individual 
Defendants,  who  are  liable  under  Corporations  Code  section  25501  for  false  and  misleading 
statements  as  alleged  herein,  and  are  also  liable  jointly  and  severally  with  and  to  the  same 
extent  as  those  persons  and  Individual  Defendants,  pursuant  to  Corporations  Code  section 
25504. 

446.  Alternatively,  at  all  times  mentioned  in  this  complaint,  each  of  the  Individual 
Defendants,  with  the  intent  to  deceive  or  defraud  the  public  (including  Plaintiff  and  Facebook’s 
minority  shareholders),  materially  assisted  other  Individual  Defendants  in  violating  section 
25401  of  the  Corporations  Code  in  that  they  signed,  approved,  authorized,  issued  and/or 
disseminated  the  false  and  misleading  statements  or  omissions  described  above,  which  the 
Individual  Defendants  knew  or  recklessly  disregarded:  (i)  were  materially  false  and/or 
incorrect;  or  (ii)  omitted  and  failed  to  disclose  material  facts  and  information  that  was  required 
to  be  disclosed  under  applicable  laws  and  regulations,  or  that  the  Individual  Defendants  knew 
was  necessary  to  make  Defendants’  statements,  in  light  of  circumstances  under  which  they 
were  made,  not  misleading,  which  caused  Facebook’s  stock  price  to  trade  at  higher  prices  than 
if  the  omitted  facts  were  disclosed,  or  if  the  facts  had  been  disclosed  truthfully.  As  a  result, 
each  of  the  Individual  Defendants  is  jointly  and  severally  liable  for  the  violation  of 
Corporations  Code  section  25401  described  in  this  complaint,  pursuant  to  Corporations  Code 
section  25504.1. 

447.  Plaintiff,  on  behalf  of  Facebook,  has  no  alternative  adequate  remedy  under 
Delaware  law. 

FOURTH  CAUSE  OF  ACTION 

Violations  of  Corporations  Code  §§  24402, 25502,  et  seq. 

(Derivatively  on  Behalf  of  Facebook  Against  Defendants  Zuckerberg,  Sandberg  &  Koum) 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

130 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


ase  4:18-cv-01792-HSG  Document  124-2  Filed  08/01/19  Page  137  of  143 

448.  Plaintiff  incorporates  by  reference  and  realleges  each  of  the  allegations  set  forth 
above  as  though  fully  set  forth  herein. 

449.  Plaintiff  is  an  individual  and  is  now,  and  at  all  times  relevant  to  this  cause  of 
action  mentioned  in  this  Complaint  was,  a  resident  of  San  Francisco  County,  California,  and  a 
shareholder  of  Facebook  Class  A  common  stock,  which  Plaintiff  has  held  continuously  during 
the  relevant  period  of  conduct  described  in  this  Complaint. 

450.  Nominal  Defendant  Facebook  is  now,  and  at  all  relevant  times  mentioned  in  this 
Complaint  was,  a  corporation  organized  and  existing  under  the  laws  of  the  State  of  Delaware, 
with  its  principal  place  of  business  in  San  Mateo  County,  California.  At  all  times  mentioned  in 
this  complaint,  Facebook  was  an  issuer  of  securities  and  was  the  issuer  of  the  shares  described 
in  this  complaint. 

451 .  Defendant  Zuckerberg  is  an  individual  and  is  now,  and  at  all  times  relevant  to 
this  cause  of  action  mentioned  in  this  Complaint  was,  a  resident  of  San  Mateo  County, 
California,  a  shareholder  of  Facebook  Class  A  common  stock,  and  an  officer  and  director  of 
Facebook  doing  business  in  San  Mateo  County,  California. 

452.  Defendant  Sandberg  is  an  individual  and  is  now,  and  at  all  times  relevant  to  this 
cause  of  action  mentioned  in  this  Complaint  was,  a  resident  of  San  Mateo  County,  California, 
and  was  a  shareholder  of  Facebook  Class  A  common  stock,  an  officer  and  director  of  Facebook 
and  a  shareholder  of  Facebook  Class  A  common  stock. 

453.  Defendant  Koum  is  an  individual  and  is  now,  and  at  all  times  relevant  to  this 
cause  of  action  mentioned  in  this  Complaint  was,  a  resident  of  Santa  Clara  County,  California, 
and  was  a  shareholder  of  Facebook  Class  A  common  stock,  an  officer  of  WhatsApp  and  a 
director  of  Facebook  doing  business  in  San  Mateo  County,  California. 

454.  At  the  time  of  the  stock  sales  set  forth  above,  each  of  defendants  Zuckerberg, 
Sandberg,  and  Koum  (the  “Insider  Selling  Defendants”)  knew  or  recklessly  disregarded  the 
information  described  in  this  Complaint  regarding  the  breach  and  illicit  data  sharing  and  sold 
Facebook  common  stock  on  the  basis  of  that  information. 
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455.  The  information  described  above  was  non-public  information  concerning  the 
Company’s  unlawful  conduct  associated  with  its  business  strategy  to  generate  revenues  through 
targeted  advertising.  The  information  was  a  proprietary  asset  belonging  to  the  Company, 
which  the  Insider  Selling  Defendants  used  for  their  own  benefit  when  they  sold  Facebook 
common  stock. 

456.  The  Insider  Selling  Defendants’  sales  of  their  shares  of  Facebook  common  stock 
while  in  possession  and  control  of  this  material  adverse  non-public  information  was  a  breach  of 
their  fiduciary  duties  of  loyalty  and  good  faith. 

457.  Because  the  use  of  the  Company’s  proprietary  information  for  their  own  gain 
constitutes  a  breach  of  the  Defendants’  fiduciary  duties,  the  Company  is  entitled  to  the 
imposition  of  a  constructive  trust  on  any  profits  the  Insider  Selling  Defendants  obtained 
thereby. 

458.  At  all  relevant  times  hereto,  defendants  Zuckerberg,  Sandberg,  and  Koum  were 
officers,  directors,  or  controlling  persons  of  Facebook.  As  a  result  of  their  positions  and 
relationships  with  Facebook,  the  Insider  Selling  Defendants  had  access,  directly  or  indirectly, 
to  material  information  about  Facebook’ s  business  and  financial  condition,  including  regarding, 
among  other  things:  (i)  the  misappropriation  of  user  information  by  Cambridge  Analytica  and 
other  third  parties;  (ii)  Defendants’  knowledge  that  Facebook’s  internal  controls  and  systems 
were  inadequate  and  ineffective  to  protect  user  data;  (iii)  Defendants’  knowledge  of  data 
security  failures  that  had  actually  materialized  and  had  not  been  disclosed;  (iv)  the  fact  that 
Facebook’s  internal  controls  and  systems  were  inadequate  to  ensure  that  the  Company 
complied  with  applicable  notification  and  disclosure  requirements,  including  with  respect  to  the 
Cambridge  Analytica  incident;  (v)  the  fact  that  Defendants  failed  to  maintain  appropriate 
policies  and  procedures  to  detect  and  prevent  violations  of  Facebook’s  policies;  and  (vi)  the 
fact  that  Defendants  failed  to  appropriately  address  Facebook’s  privacy  practices  and 
misleading  claims  regarding  same  as  required  by  the  FTC  Consent  Order;  and  (vii)  the  fact 
that,  as  a  result  of  the  foregoing,  Facebook  was  liable  for  damages,  including  fines  and 
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penalties,  and  various  other  costs  incurred  in  connection  with  adjudicated  violations  and 
potential  violations  of  various  U.S.  and  foreign  laws,  regulations,  and  the  FTC  Consent  Order, 
which  would  significantly  affect  the  market  price  of  Facebook’s  securities,  was  not  generally 
available  to  the  public,  and  which  the  Insider  Selling  Defendants  knew  was  not  intended  to  be 
available  to  the  public. 

459.  The  Insider  Selling  Defendants’  conduct  as  described  above  was  in  violation  of 
section  25402  of  the  Corporations  Code,  which  prohibits  an  officer  or  a  director  of  an  issuer 
from  purchasing  or  selling  a  security  of  the  issuer  in  California  at  a  time  when  he  or  she  knows 
material  information  about  the  issuer  gained  from  the  relationship  which  would  significantly 
affect  the  market  price  of  the  security,  is  not  generally  available  to  the  public,  and  which  he  or 
she  knows  is  not  intended  to  be  generally  available  to  the  public. 

460.  At  the  time  Facebook  repurchased  or  sold  the  shares  of  its  stock  from  or  to 
defendants  Zuckerberg,  Sandberg,  and/or  Koum  as  described  above,  the  shares  would  have  had 
a  market  value  in  an  amount  to  be  determined  after  discovery  that  is  greater  than  if  the 
information  known  to  defendants  Zuckerberg,  Sandberg,  and  Koum  had  been  publicly 
disseminated  prior  to  that  time  and  a  reasonable  time  had  elapsed  for  the  market  to  absorb  the 
information. 

461 .  Insider  Selling  Defendants  Zuckerberg,  Sandberg,  and  Koum  sold  Facebook 
securities  at  a  time  when  they  possessed  and/or  knew  material  information  about  Facebook  — 
gained  from  their  relationships  at  Facebook  —  which  was  not  generally  available  to  the  public. 
Had  such  information  been  publicly  available,  it  would  have  significantly  reduced  the  market 
price  of  Facebook  stock  at  that  time. 

462.  Insider  Selling  Defendants  Zuckerberg,  Sandberg,  and  Koum  knew  these  facts 
were  not  intended  to  be  available  to  the  public.  At  the  time  of  the  Insider  Selling  Defendants’ 
sales,  each  of  the  Insider  Selling  Defendants  had  actual  knowledge  of  material,  adverse,  non¬ 
public  information  and  sold  their  Facebook  common  stock  in  California  in  violation  of 
California  Corporations  Code  §  25402. 
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463.  Pursuant  to  the  provisions  of  Corp.  Code  §  25502,  Plaintiff,  on  behalf  of 
Facebook,  is  entitled  to  recover  damages  from  Insider  Selling  Defendants  Zuckerberg, 
Sandberg,  and  Koum  in  an  amount  equal  to  the  difference  between  the  price  at  which  the 
shares  were  sold  and  the  market  value  which  the  shares  would  have  had  at  the  time  of  the  sales 
in  2018  and  2019  the  information  known  to  the  Insider  Selling  Defendants  had  been  publicly 
disseminated  prior  to  that  time  and  a  reasonable  time  had  elapsed  for  the  market  to  absorb  the 
information,  plus  interest  at  the  legal  rate. 

464.  Pursuant  to  California  Corporations  Code  §  25502.5,  each  of  the  Insider  Selling 
Defendants  is  liable  to  Facebook  for  damages  in  an  amount  up  to  three  times  the  difference 
between  the  price  at  which  Facebook  common  stock  was  sold  by  the  Defendant  and  the  market 
value  that  stock  would  have  had  at  the  time  of  the  sale  if  the  information  known  to  the  Insider 
Selling  Defendants  had  been  publicly  disseminated  prior  to  that  time  and  a  reasonable  time  had 
elapsed  for  the  market  to  absorb  the  information. 

465.  Facebook  has  total  assets  in  excess  of  one  million  dollars  and  has  a  class  of 
equity  security  held  of  record  by  500  or  more  persons. 

466.  Insider  Selling  Defendants  Zuckerberg,  Sandberg,  and  Koum  are  also  liable  for 
reasonable  attorneys’  fees  and  costs  under  California  Corporations  Code  §  25502.5. 

467.  At  all  times  mentioned  in  this  complaint,  the  Individual  Defendants  were  officers 
and/or  directors  of  Facebook  and  in  their  positions  as  officers  and/or  directors  of  Facebook 
directly  or  indirectly  controlled  Insider  Selling  Defendants  Zuckerberg,  Sandberg,  and  Koum. 
As  a  result,  each  of  the  Individual  Defendants  is  jointly  and  severally  liable  with,  and  to  the 
same  extent  as  Insider  Selling  Defendants  Zuckerberg,  Sandberg,  and  Koum  for  the  violations 
of  Corporations  Code  section  25402  described  in  this  Complaint. 

468.  Plaintiff,  on  behalf  of  Facebook,  has  no  alternative  adequate  remedy  under 
Delaware  law. 

FIFTH  CAUSE  OF  ACTION 

Control  Person  Liability  Pursuant  to  Corporations  Code  §  25504 


COMPLAINT  FOR  DECLARATORY  JUDGMENT;  VIOLATIONS  OF  CORPORATIONS  CODE 

134 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


4:18-cv-01792-HSG  Document  124-2  Filed  08/01/19  Page  141  of  143 


(Derivatively  on  Behalf  of  Facebook  Against  the  Individual  Defendants) 

469.  Plaintiff  incorporates  by  reference  and  realleges  each  of  the  allegations  set  forth 

above,  including  the  Second  Cause  of  Action,  the  Third  Cause  of  Action,  and  the  Fourth  Cause 
of  Action,  as  though  fully  set  forth  herein. 

470.  At  all  times  mentioned  in  this  complaint,  the  Individual  Defendants  were  officers 
and/or  directors  of  Facebook,  and  in  their  positions  as  officers  and/or  directors  of  Facebook, 
directly  or  indirectly  controlled  other  Individual  Defendants  who  are  liable  under  Corporations 
Code  section  25500  for  market  manipulation,  Corporations  Code  section  25501  for  false  and 
misleading  statements  and/or  Corporations  Code  section  25502  for  insider  sales,  as  alleged 
herein.  As  a  result,  each  of  the  Individual  Defendants  is  also  liable  jointly  and  severally  with 
and  to  the  same  extent  as  those  persons  and  Individual  Defendants,  pursuant  to  Corporations 

I 

Code  section  25504. 

47 1 .  Plaintiff,  on  behalf  of  Facebook,  has  no  adequate  alternative  remedy  under 
Delaware  law. 

PRAYER  FOR  RELIEF 

WHEREFORE,  Plaintiff  requests  that  this  Court  enter  a  judgment: 

A.  Declaring  that:  (1 )  this  Court  has  jurisdiction  and  authority  to  issue  judgment  on 
all  of  the  causes  of  action  in  this  Complaint,  including  the  authority  to  determine  the  validity 
and/or  enforceability  of  the  Forum  Provision;  (2)  the  Forum  Provision  is  invalid  under 
applicable  Delaware  and/or  California  law;  (3)  the  Forum  Provision  is  unenforceable  (a)  in  the 
State  of  California,  either  because  it  is  against  public  policy  and/or  because  it  seeks  to  limit 
statutory  rights  and  remedies  under  California  law,  or,  alternatively,  (b)  as  to  Plaintiff  in  this 
action  and/or  the  causes  of  action  alleged  in  this  Complaint;  and  (4)  the  Forum  Provision  was 
adopted,  has  not  been  waived  or  modified  and/or  is  maintained  by  Facebook’s  Board,  including 
Individual  Defendants  who  are  directors,  for  an  improper  purpose  that  is  inconsistent  with  their 

i 

fiduciary  duties  owed  to  Facebook  and  its  minority  shareholders;  and  (5)  the  Forum  Provision 
was  expressly  or  tacitly  approved  by  Facebook’s  Board  through  its  adoption  of  Facebook’s 
Amended  and  Restated  Bylaws,  as  amended  and  restated  April  10,  2019,  which  Facebook’s 
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Board,  including  Individual  Defendants  who  are  directors,  adopted  and/or  approved  for  an 
improper  purpose  that  is  inconsistent  with  their  fiduciary  duties  and  which  constitutes  a  breach 
of  their  fiduciary  duties  owed  to  Facebook  and  its  minority  shareholders,  because  Facebook’s 
Amended  and  Restated  Bylaws  do  not  modify  or  allow  for  modification  of  the  Forum  Provision 
and  impose  certain  requirements  that  must  be  met  in  order  to  modify  the  Forum  Provision  that 
prevent  Plaintiff  and  Facebook’s  minority  shareholders  from  voting  to  modify  the  Forum 
Provision 

B.  Rescinding  the  sales  of  shares  by  the  Insider  Selling  Defendants,  and  awarding  to 
Facebook  restitution  from  the  Insider  Selling  Defendants,  and  each  of  them,  and  ordering 
disgorgement  of  all  profits  obtained  by  the  Insider  Selling  Defendants,  including  the  proceeds 
from  their  insider  sales  of  Facebook  stock  made  in  violation  of  the  California  securities  laws; 

C.  Awarding  to  Facebook  restitution  from  the  Individual  Defendants,  and  ordering 
the  Individual  Defendants  to  pay  to  Facebook  the  sum  of  all  consideration  that  Facebook  paid 
for  the  shares,  plus  interest  at  the  legal  rate,  in  an  amount  to  be  determined  that  reflects  the 
artificial  inflation  in  Facebook’s  stock  price  that  was  due  to  the  false  and  misleading  statements 
and  omissions; 

D.  Award  to  Facebook  the  damages  sustained  by  it  as  a  result  of  the  violations  of  the 
California  securities  laws  set  forth  above  from  each  Defendant,  jointly  and  severally,  together 
with  prejudgment  and  post-judgment  interest  thereon; 

E.  Awarding  to  Plaintiff  costs  and  disbursements  related  to  this  action,  including 
reasonable  attorneys’  fees,  consultant  and  expert  fees,  costs,  and  expenses;  and 

F.  Granting  such  other  and  further  relief  as  the  Court  may  deem  proper. 
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Dated:  Junohc?,  2019  Respectfully  submitted, 


P.  Terry  Anderlini,  Esq.,  (044783) 
ANDERLINI  &  MCSWEENEY  LLP 
66  Bovet  Road,  Suite  285 
San  Mateo,  CA  94402 
Telephone:  (650)  212-0001 
Facsimile:  (650)212-0081 


Guido  Saveri  (22349) 

R.  Alexander  Saveri  (173102) 
Cadio  Zirpoli  (179108) 
Charlie  Sweeny  (325167) 
SAVERI  &  SAVERI 
706  Sansome  Street 
San  Francisco,  CA  94111 
Telephone:  (415)217-6810 
Facsimile:  (415)217-6813 


Attorneys  for  Plaintiff 
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